{"id":55358,"date":"2021-10-14T13:00:00","date_gmt":"2021-10-14T17:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=55358"},"modified":"2024-02-20T18:49:59","modified_gmt":"2024-02-20T23:49:59","slug":"prevent-phishing-sso-mfa-policies","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies","title":{"rendered":"How to Prevent Phishing Damage Using SSO, MFA, and Policies"},"content":{"rendered":"\n<p><em>It\u2019s Cybersecurity Awareness Month! In honor of the theme \u2014 Do Your Part. #BeCyberSmart \u2014 we\u2019re doing our part by educating IT teams and organizations on protecting themselves. Throughout October, the JumpCloud blog will focus on top cybersecurity issues, from IT admin best practices to CISO responsibilities. Tune back in throughout the month for new cybersecurity content or <\/em><a href=\"https:\/\/jumpcloud.com\/blog\/search?topics=security\"><em>check out our archive of existing security articles<\/em><\/a><em> for cybersecurity insights written specifically for the IT professional.<\/em><\/p>\n\n\n\n<p><em>As part of Phight the Phish week, we want to discuss how organizations can mitigate or prevent the damage done to their resources and infrastructure due to successful phishing attacks on users.<\/em><\/p>\n\n\n\n<p>In 2020, 75% of organizations around the world experienced a phishing attack, and 74% of attacks targeting U.S. organizations were successful (<a href=\"https:\/\/expertinsights.com\/insights\/50-phishing-stats-you-should-know\/\" target=\"_blank\" rel=\"noreferrer noopener\">Expert Insights<\/a>). Phishing attacks affect all organizations, and they\u2019re often successful, no matter the targeted industry, organization size, or level of security training provided to users. However, there are controls that IT administrators can put in place to minimize the threat and consequences of phishing attacks, two of which are: implementing<a href=\"https:\/\/jumpcloud.com\/blog\/what-is-single-sign-on-sso\"> single sign-on (SSO)<\/a> and layering it with multi-factor authentication (MFA) while also limiting password changes to on a device rather than on various websites.<\/p>\n\n\n\n<p><strong>For context, in this article, we\u2019re going to define:<\/strong><\/p>\n\n\n\n<ul>\n<li><strong>A successful phishing attack<\/strong> as an event in which a bad actor successfully steals a user\u2019s credentials (primarily passwords) via phishing.<\/li>\n\n\n\n<li><strong>An organizational phishing attack<\/strong> as an event in which a user\u2019s stolen credentials are used to access organization-owned resources.<\/li>\n<\/ul>\n\n\n\n<p>Phishers utilize a number of different tactics and techniques, with a variety of intentions set to get them deeper into an organization or to profit from stolen data. Read more about the <a href=\"https:\/\/jumpcloud.com\/blog\/phishing\">fundamentals of phishing here<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Prevalence of Phishing<\/h2>\n\n\n\n<p>Because phishing attacks are so common all around the world, it\u2019s essential that your organization puts the proper controls in place to mitigate risk and reduce potential vulnerabilities. Plus, in the modern era, the prevalence of remote work leads to increased risk for organizations because employees are not working from a physical office every day where you have more control over them and their device use. On top of that, scaling an organization adds even more danger \u2014 each new user that you add creates the potential for gaps in your security to form that bad actors can and will take advantage of.<\/p>\n\n\n\n<p>One significant step you should take to prevent phishing attacks is to educate employees on the <a href=\"https:\/\/jumpcloud.com\/blog\/many-masks-phisher\">different forms of phishing<\/a>, what to do if phishing is suspected, and how to be careful rather than impulsive when reacting to emails, even when they\u2019re in a hurry. However, this is not nearly enough. Users often work quickly to meet deadlines, make assumptions without thinking critically, and, because they may reuse passwords or use similar versions of previously used passwords for business and personal accounts, this can quickly lead to a full blown security incident. Online human behavior today consists of skimming emails, clicking through items quickly, and logging into websites and apps using muscle memory, often without noticing that something seems off \u2014 which can all quickly result in a successful phishing attack.<\/p>\n\n\n\n<p>Without the right controls in place, these seemingly small events create massive security issues for your organization that can have lasting effects. This is where implementing a comprehensive <a href=\"https:\/\/jumpcloud.com\/blog\/how-sso-improves-security-and-compliance\">SSO security<\/a> solution layered with multi-factor authentication is integral. Along with that, forcing consistent on-device password changes rather than on-website password changes virtually eliminates the threat of phishing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How SSO Reduces the Risk of Phishing<\/h2>\n\n\n\n<p>Without a <a href=\"https:\/\/jumpcloud.com\/platform\/single-sign-on\">single sign-on solution<\/a> in place, not only are users and IT admins wasting time remembering and resetting a multitude of passwords and dealing with user lockout issues, but each password used to access any company resource adds a new piece of risk to the puzzle. And, once that puzzle gets too large and a mistake is made, your entire organization\u2019s infrastructure, data, personal information, and resources are all vulnerable to theft and manipulation. Organizational phishing attack prevention starts with implementing a reinforced SSO security solution \u2014 decreasing the number of attack surfaces out there inherently improves organizational security.<\/p>\n\n\n\n<p>There are SSO point solutions and comprehensive SSO solutions out there. SSO point solutions are quickly becoming a thing of the past because they focus entirely on application access and neglect other critical IT resources like devices, networks, and more, which makes the primary benefits of a comprehensive SSO solution crystal clear.<\/p>\n\n\n\n<p>Those benefits include:<\/p>\n\n\n\n<ul>\n<li>Improved user experience<\/li>\n\n\n\n<li>Efficiency of access to virtually all IT resources using a single set of credentials (in other words &#8211; it reduces the attack surfaces available)<\/li>\n\n\n\n<li>Added layers of security built around access and credential management<\/li>\n\n\n\n<li>Improved productivity within the organization&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Plus, a comprehensive SSO solution comes in the form of a <a href=\"https:\/\/jumpcloud.com\/why-jumpcloud\">cloud directory platform<\/a> that has many other security and productivity features built-in, such as MFA, password complexity requirements, on-device password change capabilities, policies, device and user management, cloud RADIUS, cloud LDAP, and more. Being able to enjoy all of these capabilities from one platform helps strengthen security because it all works together seamlessly, and there\u2019s no need for other questionable add-on solutions.<\/p>\n\n\n\n<p>After rolling out an SSO solution, most organizations immediately enforce MFA and password complexity requirements to ensure that the single password each employee uses is one that is obscure, hard-to-guess, and not easily leveraged if compromised.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How MFA Reduces the Risk of Phishing<\/h2>\n\n\n\n<p>Multi-factor authentication is an excellent security layer to add into your organization, especially for organizational phishing attack prevention \u2014 MFA requires that users trying to authenticate prove their identity by providing another <a href=\"https:\/\/jumpcloud.com\/blog\/different-factors-of-multi-factor-authentication-mfa\">factor of authentication<\/a> that only they should have possession of on top of their password. It\u2019s used to help offset the fact that passwords alone are flawed as a standalone security measure, given the reasons listed above, and, because they can be tricked into sharing those credentials with relative ease.&nbsp;<\/p>\n\n\n\n<p>Similarly, <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-step-up-authentication-and-where-does-it-come-into-play\">step-up MFA<\/a> can also be put in place to protect sensitive information to help with this type of phishing prevention. With step-up authentication, users may be allowed to access some resources without needing to provide a second factor of authentication; however, when they need to access more sensitive information, they\u2019re prompted for further authorization. Step-up authentication can even exist <em>within<\/em> an application or system, which prompts the user to supply a second factor even if they already did so to log in initially. This can stop an attacker in their tracks if they were initially successful at authenticating.<\/p>\n\n\n\n<p>Whether or not your organization currently uses <a href=\"https:\/\/jumpcloud.com\/blog\/sso-pros-cons\">SSO capabilities<\/a>, multi-factor authentication should be enforced across employee accounts. If your organization does not use SSO, that means that hundreds to thousands of different credentials may exist, and each one of those credentials is vulnerable to phishing attacks. Enforcing MFA requirements across every critical resource that each employee logs into may feel cumbersome to some \u2014 but is it worth the risk to not do it at all?<\/p>\n\n\n\n<p>The best solution to adopt in this scenario would be an SSO platform with integrated MFA capabilities to cut down on the MFA setup and reduce the overall complexity of the process for end users. However, if you already have an SSO solution in place without layered MFA, then it\u2019s past time to look into a more comprehensive security solution.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Phishing vs SSO<\/h2>\n\n\n\n<p>Without any context or background knowledge, the idea of having an SSO solution in place amidst a phishing attack can be a scary concept. A common question that arises is, \u201cWouldn\u2019t having one password that provides access to all of my organization\u2019s resources make it easier for bad actors to wreak havoc via a phishing attack?\u201d. The short answer to this is <em>no, not when it\u2019s implemented correctly<\/em> \u2014 there\u2019s a lot more that goes into this than meets the eye.<\/p>\n\n\n\n<p>If you decide to implement an SSO platform but you choose not to enforce password complexity requirements, MFA, conditional access policies, password change policies, where password changes take place (on-device), or anything related, you\u2019re still leaving your organization at more risk than necessary.&nbsp;<\/p>\n\n\n\n<p>However, if you do implement some or all of these other features across user accounts, the level of security improvement made will be drastic compared to not using SSO in the first place. The thought process in your organization should never be <a href=\"https:\/\/jumpcloud.com\/blog\/single-sign-on-vs-mfa\">SSO vs MFA<\/a> \u2014 they work together and should be used in conjunction to truly protect your users and your organization\u2019s resources and data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Prevent Organizational Phishing Attacks With SSO, MFA, and Policies<\/h2>\n\n\n\n<p>When implementing an SSO solution within your organization, the bare minimum that we recommend you do is adopt and enforce <a href=\"https:\/\/jumpcloud.com\/support\/manage-password-and-security-settings\">password complexity requirements<\/a> and regularly scheduled password change policies while enforcing main password changes only on the device, not within any web tools. These things add an important layer of security to each user\u2019s SSO credentials. Further, we recommend that you also add MFA into the mix, and if you\u2019re feeling extra proactive, throw in <a href=\"https:\/\/support.jumpcloud.com\/support\/s\/article\/Getting-Started-Conditional-Access-Policies\" target=\"_blank\" rel=\"noreferrer noopener\">conditional access policies<\/a> too.<\/p>\n\n\n\n<p>Strong password complexity requirements will ensure that users are creating new passwords that they haven\u2019t used prior, and if enforced properly, they will be very difficult to guess. With regularly scheduled password change policies on top of that, bad actors will have a much more difficult time getting ahold of any current (and hopefully complex) passwords.&nbsp;<\/p>\n\n\n\n<p>Going up the security ladder, MFA can prevent over 99.9% of account compromise attacks (<a href=\"https:\/\/www.corsicatech.com\/blog\/mfa-the-super-tool-that-can-stop-99-of-password-attacks\/\" target=\"_blank\" rel=\"noreferrer noopener\">Corsica Technologies<\/a>). And, should a malicious actor be able to bypass this security control, conditional access policies can further protect critical access by requiring specific conditions around the device and network from which access is being requested.<\/p>\n\n\n\n<p><strong>An example of MFA in action during a phishing attack:&nbsp;<\/strong><\/p>\n\n\n\n<p>A user\u2019s SSO account is layered with MFA, and a successful phishing attack gives a bad actor that user\u2019s password. When the bad actor tries to authenticate into the SSO portal, they either receive a push notification or are prompted to enter a time-based one-time password (TOTP) token that is found in an <a href=\"https:\/\/jumpcloud.com\/blog\/push-notification-mfa-using-jumpcloud-protect\">authenticator app<\/a>, which they do not have access to. Without MFA, that bad actor would\u2019ve had immediate access to any resources that were provisioned to that user.<\/p>\n\n\n\n<p>But, let\u2019s say the bad actor was able to trick the end user into submitting their TOTP token, which they were able to use to attempt to log in. In this case, conditional access policies that block authentication attempts from unmanaged devices or unapproved networks would mean the bad actor in that scenario wouldn\u2019t be able to access the organization\u2019s resources with the password and TOTP combo anyway.<\/p>\n\n\n\n<p>Hopefully in any of these unsavory situations, IT will notice that something is off with that user\u2019s login attempts and enforce an immediate password change while digging into the situation further, thus preventing the bad actors behind successful phishing attacks from accessing any organizational resources.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Organizational Phishing Prevention: JumpCloud\u2019s All-in-One Solution<\/h2>\n\n\n\n<p>The <a href=\"https:\/\/jumpcloud.com\/platform\">JumpCloud Directory Platform<\/a> includes many features that improve organizational security and user productivity. These features work to prevent any extra fallout from a successful phishing attack other than having to force a password change on an account. One of these features is what we call <a href=\"https:\/\/jumpcloud.com\/blog\/what-is-true-sso\">True SSO\u2122<\/a> which allows users to securely authenticate to virtually any IT resource they need access to, including systems, web apps, legacy apps, networks, file servers, and more, with one set of secure credentials.&nbsp;<\/p>\n\n\n\n<p>Another essential security feature is built-in <a href=\"https:\/\/jumpcloud.com\/platform\/multi-factor-authentication-mfa\">multi-factor authentication<\/a> that can be layered over SSO. Within the JumpCloud Console, there are also other features such as password complexity requirements, password reset capabilities, and conditional access policy enforcement. All of these features in JumpCloud work together seamlessly to ensure that only the right users have access to the right resources and to verify identities of those attempting to access those resources, thus minimizing the damage that successful phishing attacks can cause.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Try JumpCloud\u2019s Solution Free<\/h3>\n\n\n\n<p>Take the first step towards keeping your organization\u2019s resources safe from successful phishing attacks. Test out JumpCloud\u2019s modern, simplified IAM solution with True SSO, and see if it\u2019s right for your organization! Create a <a href=\"https:\/\/console.jumpcloud.com\/signup\" target=\"_blank\" rel=\"noreferrer noopener\">JumpCloud Free<\/a> account to access the entirety of the platform for free, up to 10 users and 10 devices. Along with that, enjoy 24\u00d77 in-app support \u2014 free for the first 10 days!<\/p>\n\n\n\n<div class=\"promotion-banner-small is-flex-direction-column has-items-aligned-flex-start has-items-aligned-center-tablet\">\n    <div class=\"promo-small-image is-hidden-mobile\">\n        <img decoding=\"async\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Hyper-Secure-with-SSO-MFA-1-aspect-ratio-160-110.jpg\" alt=\"JumpCloud\">\n    <\/div>\n    <div class=\"promo-small-content\">\n        <p class=\"is-type-body-tiny is-type-weight-bold is-important promo-small-title\">\n                    <\/p>\n        <p class=\"is-type-body-default is-important\">\n            JumpCloud\u2019s Identity and Access Management Solution With SSO        <\/p>\n    <\/div>\n    <div class=\"promo-small-cta\">\n        <a href=\"https:\/\/console.jumpcloud.com\/signup\" data-promo=\"JC Free - SSO and IAM\" class=\"button is-primary-green promo-small-banner-link\">Get Started<\/a>\n    <\/div>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>Phishing is incredibly common and tricky. Learn how to prevent phishing damage by implementing SSO, MFA, and organization-wide policies.<\/p>\n","protected":false},"author":143,"featured_media":55361,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[2781,2337],"tags":[],"collection":[2775,2780],"platform":[],"funnel_stage":[3015],"coauthors":[2533],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Prevent Phishing Damage Using SSO, MFA, and Policies - JumpCloud<\/title>\n<meta name=\"description\" content=\"Phishing is incredibly common and tricky. Learn how to prevent phishing damage by implementing SSO, MFA, and organization-wide policies.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Prevent Phishing Damage Using SSO, MFA, and Policies\" \/>\n<meta property=\"og:description\" content=\"Phishing is incredibly common and tricky. Learn how to prevent phishing damage by implementing SSO, MFA, and organization-wide policies.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:author\" content=\"matt.renstrom\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-14T17:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-20T23:49:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1372\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Brenna Lee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Brenna Lee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#article\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies\"},\"author\":{\"name\":\"Brenna Lee\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/359d7999806d5e67935965c2dd3d28e7\"},\"headline\":\"How to Prevent Phishing Damage Using SSO, MFA, and Policies\",\"datePublished\":\"2021-10-14T17:00:00+00:00\",\"dateModified\":\"2024-02-20T23:49:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies\"},\"wordCount\":2093,\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg\",\"articleSection\":[\"How-To\",\"Remote Work\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies\",\"url\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies\",\"name\":\"Prevent Phishing Damage Using SSO, MFA, and Policies - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg\",\"datePublished\":\"2021-10-14T17:00:00+00:00\",\"dateModified\":\"2024-02-20T23:49:59+00:00\",\"description\":\"Phishing is incredibly common and tricky. Learn how to prevent phishing damage by implementing SSO, MFA, and organization-wide policies.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg\",\"width\":1920,\"height\":1372,\"caption\":\"Fishing-pole-symbolizing-phishing\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Prevent Phishing Damage Using SSO, MFA, and Policies\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/359d7999806d5e67935965c2dd3d28e7\",\"name\":\"Brenna Lee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/a512f44ee3cc1a59010e879f81d8b53c\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/967dd7256974fbbeb3db3f2549c2da47?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/967dd7256974fbbeb3db3f2549c2da47?s=96&d=mm&r=g\",\"caption\":\"Brenna Lee\"},\"description\":\"Brenna is a Content Writer at JumpCloud that loves learning about and immersing herself in new technologies. Outside of the [remote] office, she loves traveling and exploring the outdoors!\",\"sameAs\":[\"https:\/\/jumpcloud.com\/blog\",\"matt.renstrom\",\"stefano.tomasello@jumpcloud.com\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Prevent Phishing Damage Using SSO, MFA, and Policies - JumpCloud","description":"Phishing is incredibly common and tricky. Learn how to prevent phishing damage by implementing SSO, MFA, and organization-wide policies.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies","og_locale":"en_US","og_type":"article","og_title":"How to Prevent Phishing Damage Using SSO, MFA, and Policies","og_description":"Phishing is incredibly common and tricky. Learn how to prevent phishing damage by implementing SSO, MFA, and organization-wide policies.","og_url":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies","og_site_name":"JumpCloud","article_author":"matt.renstrom","article_published_time":"2021-10-14T17:00:00+00:00","article_modified_time":"2024-02-20T23:49:59+00:00","og_image":[{"width":1920,"height":1372,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg","type":"image\/jpeg"}],"author":"Brenna Lee","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Brenna Lee","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#article","isPartOf":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies"},"author":{"name":"Brenna Lee","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/359d7999806d5e67935965c2dd3d28e7"},"headline":"How to Prevent Phishing Damage Using SSO, MFA, and Policies","datePublished":"2021-10-14T17:00:00+00:00","dateModified":"2024-02-20T23:49:59+00:00","mainEntityOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies"},"wordCount":2093,"publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg","articleSection":["How-To","Remote Work"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies","url":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies","name":"Prevent Phishing Damage Using SSO, MFA, and Policies - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg","datePublished":"2021-10-14T17:00:00+00:00","dateModified":"2024-02-20T23:49:59+00:00","description":"Phishing is incredibly common and tricky. Learn how to prevent phishing damage by implementing SSO, MFA, and organization-wide policies.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#primaryimage","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/10\/Fishing-rod-in-water.jpg","width":1920,"height":1372,"caption":"Fishing-pole-symbolizing-phishing"},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/blog\/prevent-phishing-sso-mfa-policies#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"How to Prevent Phishing Damage Using SSO, MFA, and Policies"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/359d7999806d5e67935965c2dd3d28e7","name":"Brenna Lee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/a512f44ee3cc1a59010e879f81d8b53c","url":"https:\/\/secure.gravatar.com\/avatar\/967dd7256974fbbeb3db3f2549c2da47?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/967dd7256974fbbeb3db3f2549c2da47?s=96&d=mm&r=g","caption":"Brenna Lee"},"description":"Brenna is a Content Writer at JumpCloud that loves learning about and immersing herself in new technologies. Outside of the [remote] office, she loves traveling and exploring the outdoors!","sameAs":["https:\/\/jumpcloud.com\/blog","matt.renstrom","stefano.tomasello@jumpcloud.com"]}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/55358"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/143"}],"replies":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/comments?post=55358"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/55358\/revisions"}],"predecessor-version":[{"id":106232,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/55358\/revisions\/106232"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media\/55361"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=55358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/categories?post=55358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/tags?post=55358"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/collection?post=55358"},{"taxonomy":"platform","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/platform?post=55358"},{"taxonomy":"funnel_stage","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/funnel_stage?post=55358"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=55358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}