Comments
Stolen Passwords Used In Most Data Breaches
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
ChrisB093
50%
50%
ChrisB093,
User Rank: Strategist
4/24/2014 | 9:47:52 AM
Solutions to stop credentials-based-attack
Despite the widespread occurance and high profile too many corporations are not doing enough to mitigate the risk of security breaches from password based attacks.

Such an attacker is likely to log in with stolen credentials from an abnormal location at an unusual time. Restricting user's individual access to the network by physical location (workstation or device, IP range, department, floor, building...) and setting usage/connection time limits helps organizations avoid these credentials-based attacks.

In addition by preventing concurrent logins network vulnerability is significantly reduced. This limits users to only one possible connection at any one instant making it impossible for any rogue user to use valid credentials at the same time as their legitimate owner, wherever they are based.

Our solution UserLock ensures unauthorized access is no longer possible for Windows based infrastructures - even when credentials are compromised. It stops malicious users seamlessly using valid credentials. 

We blog further about internal security breaches from password based attacks here: http://www.isdecisions.com/blog/it-security/internal-security-breaches-from-password-based-attacks/
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/23/2014 | 6:00:25 PM
Re: Supplement Security With Access Analytics
Thanks so much for sharing your insight and experience with this @douglasmow. What seems to be such a basic thing to secure and track, a logon & password, always seems to rear its ugly head. The Verizon DBIR put an exclamation point on it, that's for sure. 
douglasmow
50%
50%
douglasmow,
User Rank: Apprentice
4/23/2014 | 4:51:46 PM
Supplement Security With Access Analytics
@Kelly, Your story covering the 2014 Verizon DBIR highlights something we work to continuously convey to customers... what may look like a customer or partner or staff member, may not in fact be so. With the report citing 2 out of 3 data breaches are from stolen credentials, organizations with insight into who is accessing what information for what purpose will be able to better detect, deter and possibly even prevent a breach. The only way to gain this insight is by applying analytics to the big data of identity and access. By analyzing user access rights and the associated risk on a continuous basis, organizations can identify suspicious behavior patterns to expose external, as well as internal, threats of inappropriate access.

 

@Robert, agree fortifying perimeter defense is critical but security can be enhanced by knowing who should be accessing what once a user, legitimate or not, is inside.

 
Markus5
50%
50%
Markus5,
User Rank: Strategist
4/23/2014 | 6:09:44 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Isn't it time for everyone to start using a password management system? I use Sticky Password, but there are many others out there.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/22/2014 | 11:51:48 AM
Re: The Verizon Data Breach Investigations Report bears a close look
In case you missed the link to the full report in Kelly's news story, you can get all the details here
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/22/2014 | 10:31:04 AM
Re: Let's Talk About Response In Addition To Defense
Totally agree, @Drew Conry-Murray. I've been writing a series on IR's role in security (was on hold for  Heartbleed but another installment coming on Thursday :-) ), and the bottom line is that by necessity, IR is gradually becoming part and parcel of a good security strategy.
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/22/2014 | 10:27:37 AM
Let's Talk About Response In Addition To Defense
Attackers have the advantage: they only need to find one flaw to get a beachhead, while the defenders have to be perfect all the time. It seems like the security industry is starting to put more emphasis on how organizations respond to an incident, instead of going for the impossible standard of perfect security. It's important to have a robust defense, but just like companies have DR/BC plans, they also need to have breach response plans in place.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/22/2014 | 10:00:13 AM
Re: Phish vs. Use of Credentials
@Robert. I agree with your multifactor authentication. Also, now that biometrics is increasing in popularity, what are the breach trends in accordance with this type multi-factor setup. (Biometrics & Hardcode passwords) My organization doesn't use biometrics and I am unsure how many organizations do but I am curious to see what difficulties they are facing in this space.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/22/2014 | 8:22:24 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Absolutely, Tim. There is a lot to the report, as always. Even more so this year with the broader and more global input. This year's report is a truly global and comprehensive look at what's really happening in data breaches as well as other security incidents. As always, we'll be drawing from its findings all year long. 

 
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
4/22/2014 | 8:10:41 AM
The Verizon Data Breach Investigations Report bears a close look
Great story from Kelly Jackson Higgins, but if you can make the time, it's worth reading the entire Verizon DBIR from beginning to end. The DBIR is one of the most interesting security studies released each year because it is not a survey -- it's data collected from actual breaches that Verizon and partners have investigated in the past year.

Surveys are great, but in security sometimes respondents don't give all the details of their posture, or simply don't know what they don't know. The DBIR shows the actual reasons behind major security breaches, how they occurred, and what their impact was. It's a great benchmark for the industry, and sometimes brings our flaws or faulty practices that enterprises have overlooked.
Page 1 / 2   >   >>


White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.