Skip to main content

MFA disabled for GitHub organization or enterprise

ID:github_mfa_disabled
Data type:GitHub
Severity:
Low
MITRE ATT&CK:TA0003:T1556.006

Description​

AlphaSOC detected that multi-factor authentication (MFA) was disabled for a GitHub organization or enterprise. MFA serves as a critical security control by requiring users to provide two forms of authentication before accessing GitHub resources.

Impact​

Disabling MFA increases the risk of unauthorized access through compromised credentials. Threat actors can leverage stolen passwords to access source code, intellectual property, and sensitive configurations. This access enables adversaries to modify code, insert malware, or steal secrets stored in repositories.

Severity​

SeverityCondition
Low
MFA disabled for GitHub organization or enterprise

Investigation and Remediation​

Review GitHub audit logs to identify who disabled MFA and when. Re-enable MFA immediately for the organization. Enforce MFA for all users and administrative accounts. Review repository access logs for suspicious activity. Rotate any exposed secrets or credentials. Review GitHub security settings and access controls.