Generic identity, MFA & sign-in security checks
Who can sign in, how strongly they authenticate, and whether sessions, passwords and sign-in locations meet the baseline every admin account should clear.
On Generic, Black Cat runs 8 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies.
Checks (8)
severity: high Login from Residential Proxy fix difficulty: medium #
Investigate the login source and enforce conditional access or IP allowlists to block residential proxy usage
- Identify the user account and source IP address from the finding details
- Determine whether the user has a legitimate reason to access corporate SaaS via a residential proxy
- Review recent activity for the account in your identity provider audit logs for additional anomalies
- If unauthorized or suspicious, revoke active sessions and require the user to re-authenticate
- Enforce conditional access policies or IP allowlists in your identity provider to block residential proxy ingress
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: medium Login from Datacenter Proxy fix difficulty: medium #
Verify the datacenter IP is from an authorized VPN or cloud egress, and restrict access if not
- Identify the user account and datacenter IP address from the finding details
- Cross-reference the IP against your organization's known VPN egress ranges and authorized cloud NAT gateways
- If the IP is not from an approved source, contact the user out-of-band to confirm the login was intentional
- Review identity provider logs for other logins from the same datacenter IP range
- Update your conditional access policy to require additional verification for unrecognized datacenter sources
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: critical High Confidence Proxy Login fix difficulty: medium #
Block the high-confidence proxy IP and require step-up authentication for the affected account immediately
- Identify the user account and source IP address flagged with a high proxy confidence score
- Immediately revoke active sessions for the affected account in your identity provider
- Block the source IP at your network perimeter or in your identity provider's IP blocklist
- Contact the user out-of-band to verify whether the login was intentional
- Require re-authentication with hardware MFA or a FIDO2 security key before restoring access
- Review all actions performed during the session for signs of unauthorized activity
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Failed Login from Proxy fix difficulty: medium #
Investigate failed login attempts from proxy IPs for credential stuffing or brute force activity and block the source
- Identify the targeted account and source IP address from the finding details
- Query identity provider logs for the total count of failed attempts from this IP and time window
- Determine whether multiple accounts were targeted from the same proxy IP, which indicates credential stuffing
- Block the source IP at your network perimeter or identity provider if brute force patterns are confirmed
- Enable account lockout policies and rate limiting on authentication endpoints if not already in place
- Reset credentials for any accounts that show signs of compromise and notify affected users
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: critical Admin Login from Proxy fix difficulty: medium #
Investigate admin proxy login immediately and enforce step-up authentication for all admin accounts
- Identify the admin account and source IP address from the finding details
- Contact the admin user out-of-band to verify whether the login attempt was intentional
- If unauthorized, rotate the account credentials and revoke all active sessions immediately
- Review identity provider audit logs for all actions performed by the admin account during the session
- Enforce IP allowlist or require hardware MFA for all admin accounts to prevent future proxy-based logins
Satisfies: NIS2 Directive NIS2-21.a.2 DORA (SaaS Security) DORA-9.9
severity: high Login from Disallowed Country fix difficulty: medium #
Confirm whether the login from a disallowed country was authorized; if not, revoke sessions and tighten conditional access
- Identify the user account, source country, and IP from the finding details
- Confirm with the user out-of-band whether the access was intentional (travel, relocation, VPN egress)
- If unauthorized, revoke active sessions and force re-authentication in the identity provider
- Review the tenant geo policy to confirm the country list reflects current business needs
- Add conditional access / IP allowlist rules in the identity provider to block the disallowed region
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.2
severity: medium Login from New Country fix difficulty: medium #
Verify a login from a country not previously seen for this account is legitimate
- Identify the user account, new country, and source IP from the finding details
- Compare against the account's historical login geography in the geo observation drill-down
- Confirm with the user out-of-band whether the new-country access was intentional
- If suspicious, revoke active sessions and require re-authentication
- Consider adding the country to the tenant geo deny list if access from it is never expected
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.2
severity: high Impossible Travel Login fix difficulty: medium #
Two logins from distant countries within a window too short for physical travel — likely credential compromise or session theft. Distance is approximate (country-centroid based).
- Identify the account, the two countries, the time gap, and implied speed from the finding details
- Confirm with the user out-of-band whether both logins were theirs (VPN egress can cause benign hops)
- If unauthorized, revoke all active sessions and force re-authentication in the identity provider
- Add conditional-access / impossible-travel rules in the identity provider
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.2