Defending Against SIM Swapping, AI-Driven Social Engineering (eBook)

Organized crime groups are increasingly using SIM swapping and social engineering to bypass authentication and gain control of a victim's identity, said Microsoft's Sherrod DeGrippo.

See Also: How Tri-Counties Regional Center Secures Sensitive Files and Maintains HIPAA Compliance

A younger generation of cybercriminals is infiltrating accounts by exploiting mobile phones as the gateway to a person's identity, which she said is driving the need for robust multifactor authentication that goes beyond simple SMS verification. Text-based authentication isn't sufficient to protect against modern threats, and DeGrippo stressed the urgency of using passkeys and hardware-based MFA methods (see: A Strategic Approach to Stopping SIM Swap Fraud).

"We typically say, 'Threat actors don't hack in - they log in,' which is very true most of the time," DeGrippo said. "Threat actors that are doing SIM swapping have really figured out, 'Hey, I can bypass quite a lot of things if I can simply become this person through their phone.'"

In this interview with Information Security Media Group at Black Hat 2024, DeGrippo also discussed:

• Why SIM swapping has become so popular and who is being targeted;
• The role of AI in accelerating cybercrime tactics such as social engineering;
• How multifactor authentication and organizational playbooks boost resilience.

Before becoming Microsoft's director of threat intelligence strategy in 2023, DeGrippo led a global team of threat researchers, malware reverse engineers and threat intelligence analysts. DeGrippo's career in cybersecurity spans 20 years, and her roles include leader of red team services at Nexum, solutions engineer for Symantec, security consultant for Secureworks, and analyst for the National Nuclear Security Administration.

For more threat intelligence and actionable insights, visit Security Insider.