Some takeaways & thanks @karit.nz#OWASPNZ

We should always use MFA & SSO if you can. @karit.nz#OWASPNZ

Self service password resets can also be attacked @karit.nz#OWASPNZ

Don't treat corporate enrolled devices as a second factor @karit.nz#OWASPNZ

Uh... Also we need to make sure these apply to all cloud apps. Very easy to forget admin apps. @karit.nz#OWASPNZ

What if we have a CAP that disables MFA from the office IP? Well the guest network is probably also on that IP... @karit.nz#OWASPNZ

We can change the "user agent" to bypass a targeted CAP @karit.nz#OWASPNZ

Let's create a CAP @karit.nz#OWASPNZ

Nitty gritty of CAPs @karit.nz#OWASPNZ