Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Stolen Passwords Used In Most Data Breaches
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
ChrisB093
50%
50%
ChrisB093,
 User Rank: Strategist
4/24/2014 | 9:47:52 AM
Solutions to stop credentials-based-attack
Despite the widespread occurance and high profile too many corporations are not doing enough to mitigate the risk of security breaches from password based attacks.

Such an attacker is likely to log in with stolen credentials from an abnormal location at an unusual time. Restricting user's individual access to the network by physical location (workstation or device, IP range, department, floor, building...) and setting usage/connection time limits helps organizations avoid these credentials-based attacks.

In addition by preventing concurrent logins network vulnerability is significantly reduced. This limits users to only one possible connection at any one instant making it impossible for any rogue user to use valid credentials at the same time as their legitimate owner, wherever they are based.

Our solution UserLock ensures unauthorized access is no longer possible for Windows based infrastructures - even when credentials are compromised. It stops malicious users seamlessly using valid credentials. 

We blog further about internal security breaches from password based attacks here: http://www.isdecisions.com/blog/it-security/internal-security-breaches-from-password-based-attacks/
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
 User Rank: Strategist
4/23/2014 | 6:00:25 PM
Re: Supplement Security With Access Analytics
Thanks so much for sharing your insight and experience with this @douglasmow. What seems to be such a basic thing to secure and track, a logon & password, always seems to rear its ugly head. The Verizon DBIR put an exclamation point on it, that's for sure. 
douglasmow
50%
50%
douglasmow,
 User Rank: Apprentice
4/23/2014 | 4:51:46 PM
Supplement Security With Access Analytics
@Kelly, Your story covering the 2014 Verizon DBIR highlights something we work to continuously convey to customers... what may look like a customer or partner or staff member, may not in fact be so. With the report citing 2 out of 3 data breaches are from stolen credentials, organizations with insight into who is accessing what information for what purpose will be able to better detect, deter and possibly even prevent a breach. The only way to gain this insight is by applying analytics to the big data of identity and access. By analyzing user access rights and the associated risk on a continuous basis, organizations can identify suspicious behavior patterns to expose external, as well as internal, threats of inappropriate access.

 

@Robert, agree fortifying perimeter defense is critical but security can be enhanced by knowing who should be accessing what once a user, legitimate or not, is inside.

 
Markus5
50%
50%
Markus5,
 User Rank: Strategist
4/23/2014 | 6:09:44 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Isn't it time for everyone to start using a password management system? I use Sticky Password, but there are many others out there.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
4/22/2014 | 11:51:48 AM
Re: The Verizon Data Breach Investigations Report bears a close look
In case you missed the link to the full report in Kelly's news story, you can get all the details here. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
 User Rank: Strategist
4/22/2014 | 10:31:04 AM
Re: Let's Talk About Response In Addition To Defense
Totally agree, @Drew Conry-Murray. I've been writing a series on IR's role in security (was on hold for  Heartbleed but another installment coming on Thursday :-) ), and the bottom line is that by necessity, IR is gradually becoming part and parcel of a good security strategy.
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
 User Rank: Ninja
4/22/2014 | 10:27:37 AM
Let's Talk About Response In Addition To Defense
Attackers have the advantage: they only need to find one flaw to get a beachhead, while the defenders have to be perfect all the time. It seems like the security industry is starting to put more emphasis on how organizations respond to an incident, instead of going for the impossible standard of perfect security. It's important to have a robust defense, but just like companies have DR/BC plans, they also need to have breach response plans in place.
RyanSepe
50%
50%
RyanSepe,
 User Rank: Ninja
4/22/2014 | 10:00:13 AM
Re: Phish vs. Use of Credentials
@Robert. I agree with your multifactor authentication. Also, now that biometrics is increasing in popularity, what are the breach trends in accordance with this type multi-factor setup. (Biometrics & Hardcode passwords) My organization doesn't use biometrics and I am unsure how many organizations do but I am curious to see what difficulties they are facing in this space.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
 User Rank: Strategist
4/22/2014 | 8:22:24 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Absolutely, Tim. There is a lot to the report, as always. Even more so this year with the broader and more global input. This year's report is a truly global and comprehensive look at what's really happening in data breaches as well as other security incidents. As always, we'll be drawing from its findings all year long. 

 
DarkReadingTim
50%
50%
DarkReadingTim,
 User Rank: Strategist
4/22/2014 | 8:10:41 AM
The Verizon Data Breach Investigations Report bears a close look
Great story from Kelly Jackson Higgins, but if you can make the time, it's worth reading the entire Verizon DBIR from beginning to end. The DBIR is one of the most interesting security studies released each year because it is not a survey -- it's data collected from actual breaches that Verizon and partners have investigated in the past year.

Surveys are great, but in security sometimes respondents don't give all the details of their posture, or simply don't know what they don't know. The DBIR shows the actual reasons behind major security breaches, how they occurred, and what their impact was. It's a great benchmark for the industry, and sometimes brings our flaws or faulty practices that enterprises have overlooked.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises Are Assessing Cybersecurity Risk in Today's Environment
The adoption of cloud services spurred by the COVID-19 pandemic has resulted in pressure on cyber-risk professionals to focus on vulnerabilities and new exposures that stem from pandemic-driven changes. Many cybersecurity pros expect fundamental, long-term changes to their organization's computing and data security due to the shift to more remote work and accelerated cloud adoption. Download this report from Dark Reading to learn more about their challenges and concerns.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-4172
PUBLISHED: 2022-01-22
Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
CVE-2022-23807
PUBLISHED: 2022-01-22
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
CVE-2022-23808
PUBLISHED: 2022-01-22
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
CVE-2022-21707
PUBLISHED: 2022-01-21
wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their capabilities for inbound invocations, bu...
CVE-2022-21708
PUBLISHED: 2022-01-21
graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL han...