were a hospital IT department and use authenticator app codes for MFA today. after haering about push-bombing attacks, Im wondering whether were as protected as we think. users approve things without reading, and phishing kits proxy everything aynway. whats a realistic next step that wont cause a helpdesk riot?
we dont have a big security team.. 🙏 its basically me and one colleague, plus a helpdesk that already handles alot of password resets 👍 whatever we choose has to be supportable by a small team, not just secure on paper.
