Ransomware in Finance: Prevent AD Compromise with MFA | IS Decisions

Ransomware in Finance: Prevent AD Compromise with MFA

This article was originally published by LOGON’s partner IS Decisions. Click here to view the original article.

Behind the headlines of many major ransomware attacks lurks an unpalatable truth: even the biggest, best-resourced organizations can be undone by a single weak or compromised credential.

MFA needs to be always on, for every account — and nowhere is that more true than in finance.

The Financial Sector’s Ransomware Problem

According to the Sophos State of Ransomware in Financial Services 2024, 65% of surveyed financial services organizations reported being affected by ransomware.

Why Finance Is Targeted	Why It Matters
Valuable customer data	The asset ransomware gangs are most interested in stealing
Complex legacy infrastructure	Difficult to defend
Regulation and reputation	Regulators and investors see disruption as systemic risk
Sensitive to disclosure	Financial institutions are often careful not to publicize attacks

How Attackers Use Active Directory to Move Laterally

Stage	What Happens
1. Credential compromise	Attackers breach an organization’s defenses via weak credentials
2. AD Domain Controllers targeted	AD is the foundation of network identity and access
3. Lateral movement	Attackers use AD access to move inside the network
4. Ransomware deployment	Attackers encrypt the DC itself or critical systems

The challenge: AD lacks built-in monitoring. Security teams often only realize a compromise has happened when it’s too late.

Defending Active Directory Limits Ransomware Spread

UserLock adds a security layer at the AD authentication layer, working alongside existing AD policies.

Key capabilities:

Capability	What It Does
MFA for all accounts	Protects credentials used to gain access via the perimeter
Granular MFA policies	Balance security and user productivity
Lateral movement protection	MFA stands in the way of UAC prompts and privilege elevation attempts

“MFA needs to be always on, for every account — not only for high-privilege accounts.”

Add Extra Protection with Session-Based and Contextual Access Controls

MFA alone isn’t enough. UserLock also includes:

Control	What It Does
Concurrent session limits	Restricts multiple connections opened by a single user
Device/geolocation restriction	Limits access by device or location
Session type restriction	Limits access by connection type (workstation, terminal, VPN, etc.)
Time-based access	Restricts access by time of day

“Even if a credential is stolen, its misuse can be contained.”

Monitor User Account Behavior to Spot Unusual Activity

AD doesn’t provide native monitoring. UserLock steps in with:

Feature	What It Does
Real-time session management	Get notified instantly for any unusual access
Customizable alerts	Reduce noise by alert criteria (access event, session type)

Combine MFA and Contextual Access Controls for Stronger AD Security

Zero trust approach to AD authentication:

Principle	How UserLock Implements It
Protect credentials with MFA	Always-on MFA for every account
Enforce contextual access controls	Across all accounts, not only privileged ones
MFA beyond initial logon	On privilege elevation requests (UAC prompts)
Full on-prem or hybrid	Comprehensive approach to identity verification and access control

Ready to secure your financial institution’s Active Directory?

LOGON Software Asia – the trusted IS Decisions partner across Asia – offers:

✅ Free Proof of Concept (POC)
✅ Preferred pricing
✅ Priority support
✅ Local expertise

User Logon Security for Windows Active Directory

Enable customized, two-factor authentication (2FA) on Windows logon, Remote Desktop (RDP & RD Gateway), IIS, VPN and Cloud Applications. Apply customized login restrictions by user, group or organizational unit (OU).

Solution Highlight

Get started with UserLock

Start a free trial with UserLock, with 30-day full version, no user limit, and free technical support.

Start Your Free Trial

Blog, ISDecision Blog, UserLock