Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/24/2019
10:00 AM
Matt Davey
Matt Davey
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

The Night Before 'Breachmas'

What does identity management have to do with Charles Dickens' classic 'A Christmas Carol'? A lot more than you think.

In Charles Dickens' A Christmas Carol, Ebenezer Scrooge — played by Michael Caine in the best version, The Muppet Christmas Carol — is visited by three ghosts who foretell his future based on his past and current actions. Since Scrooge is such a coldhearted person, his future is … grim.

There's an interesting parallel here: An individuals' cybersecurity hygiene can also predict the cybersecurity future of an entire enterprise. Whether that future is grim or great depends on the leadership from security teams to correct earlier, unsafe individual Internet interactions.

The Ghost of Passwords Past
It's almost 2020: Have you deleted your MySpace profile? If not, it's worth a visit, no matter how cringey the experience might be. While obsolete social media pages may be nostalgic for individuals, they're a jackpot for attackers who mine old sites for information that can be used to answer security questions. What was the model of your first car? Check Tumblr. Who was your first crush? Check Friendster. What's a likely password? Check your AOL Instant Messenger name. If that information is there for you, it's also likely there for employees across your entire organization.

A savvy attacker could trigger a "forgot password?" flow and change a team member's password simply by entering security answers discovered by perusing that person's Internet presence. There's also an exceptional amount of information lingering about each of us in old forums, sites, and social media. That's nothing short of chilling.

The Ghost of Passwords Present
There's another component to this digital pillaging: reusing passwords. Enterprises spend untold amounts of money hardening their digital infrastructure, but all that security can be undone with valid credentials. Is the password you're currently using similar to passwords you used in high school? Possibly. Count how many employees are currently using logins across your organization and then consider how many of them are likely reusing the same password from app to app. That number is higher than you may realize. Even the most security-minded of us are guilty of reusing passwords in the interest of saving time and frustration.

Old passwords can be bought for pennies on the Dark Web, but they can also be found by cleverly infiltrating old websites that don't have today's security. It's unlikely LiveJournal, for instance, has the same security as Cisco. That means an employee's old login can be determined fairly easily, and an attacker can try that login and variations of it to attempt logging into an enterprise system. The implications of that are downright haunting. According to a study from the Ponemon Institute, a negligent employee costs the organization $283,281 per incident. Worse, attackers may not even make their presence known, choosing instead to repeatedly log in with legitimate credentials and silently leech information for years at a time.

The Ghost of Passwords Future
When the attackers are finally discovered, the results can be disastrous. Consider the Flipboard breach, for instance, which could have affected over 100 million users (the extent isn't yet known). The breach was blamed on poor cyber hygiene. Users reused their passwords on numerous sites and systems, and an attacker likely obtained a user's password from an account with weaker security. Then, it was simply a matter of using credential stuffing to automate the attack process and enter passwords into a variety of sites until one worked.

That's not the only example. Reusing passwords that have been involved in previous breaches results in still more breaches, like the 44 million account users compromised in the Microsoft and Azure cloud breach earlier this month. It's a practical reality that an employee's old Yahoo login could be the very thing to take down a system guarding millions of customers' sensitive information.

Outsmarting the Ghosts
First, scrub your Internet presence. Delete old social media accounts and omit personal information from LinkedIn and other current social media.

Next, start changing passwords. Make sure they're completely different from any former passwords. In fact, don't tie them to any facet of your life at all. For instance, resist the temptation to use your dog's name.

Finally, get your employees to do the same. Cybersecurity hygiene starts with cybersecurity education: If people understand the reason why they're being asked to be so diligent about making unique, strong passwords, they'll be much more likely to comply. And while you can't expect them to delete their old MySpace account, you can make them aware of the dangers of leaving their personal information in the open.

In A Christmas Carol, Scrooge learns from his past mistakes and mends his ways, resulting in a happy Christmas and a hopeful future. May we all learn from our past Internet selves and herald a brighter, more secure Internet of tomorrow.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "5 Pieces of GDPR Advice for Teams Without Privacy Compliance Staff."

 

Matt Davey is the COO (Chief Operations Optimist) at 1Password, a password manager that secures identities and sensitive data for enterprises and their employees. In a previous life working with agencies and financial companies, Matt has seen first-hand how important security ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17478
PUBLISHED: 2020-08-10
ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.
CVE-2020-15648
PUBLISHED: 2020-08-10
Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.
CVE-2020-15649
PUBLISHED: 2020-08-10
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR...
CVE-2020-15650
PUBLISHED: 2020-08-10
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Fir...
CVE-2020-15651
PUBLISHED: 2020-08-10
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 28.