Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Stolen Passwords Used In Most Data Breaches
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
ChrisB093
50%
50%
ChrisB093,
User Rank: Strategist
4/24/2014 | 9:47:52 AM
Solutions to stop credentials-based-attack
Despite the widespread occurance and high profile too many corporations are not doing enough to mitigate the risk of security breaches from password based attacks.

Such an attacker is likely to log in with stolen credentials from an abnormal location at an unusual time. Restricting user's individual access to the network by physical location (workstation or device, IP range, department, floor, building...) and setting usage/connection time limits helps organizations avoid these credentials-based attacks.

In addition by preventing concurrent logins network vulnerability is significantly reduced. This limits users to only one possible connection at any one instant making it impossible for any rogue user to use valid credentials at the same time as their legitimate owner, wherever they are based.

Our solution UserLock ensures unauthorized access is no longer possible for Windows based infrastructures - even when credentials are compromised. It stops malicious users seamlessly using valid credentials. 

We blog further about internal security breaches from password based attacks here: http://www.isdecisions.com/blog/it-security/internal-security-breaches-from-password-based-attacks/
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/23/2014 | 6:00:25 PM
Re: Supplement Security With Access Analytics
Thanks so much for sharing your insight and experience with this @douglasmow. What seems to be such a basic thing to secure and track, a logon & password, always seems to rear its ugly head. The Verizon DBIR put an exclamation point on it, that's for sure. 
douglasmow
50%
50%
douglasmow,
User Rank: Apprentice
4/23/2014 | 4:51:46 PM
Supplement Security With Access Analytics
@Kelly, Your story covering the 2014 Verizon DBIR highlights something we work to continuously convey to customers... what may look like a customer or partner or staff member, may not in fact be so. With the report citing 2 out of 3 data breaches are from stolen credentials, organizations with insight into who is accessing what information for what purpose will be able to better detect, deter and possibly even prevent a breach. The only way to gain this insight is by applying analytics to the big data of identity and access. By analyzing user access rights and the associated risk on a continuous basis, organizations can identify suspicious behavior patterns to expose external, as well as internal, threats of inappropriate access.

 

@Robert, agree fortifying perimeter defense is critical but security can be enhanced by knowing who should be accessing what once a user, legitimate or not, is inside.

 
Markus5
50%
50%
Markus5,
User Rank: Strategist
4/23/2014 | 6:09:44 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Isn't it time for everyone to start using a password management system? I use Sticky Password, but there are many others out there.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/22/2014 | 11:51:48 AM
Re: The Verizon Data Breach Investigations Report bears a close look
In case you missed the link to the full report in Kelly's news story, you can get all the details here
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/22/2014 | 10:31:04 AM
Re: Let's Talk About Response In Addition To Defense
Totally agree, @Drew Conry-Murray. I've been writing a series on IR's role in security (was on hold for  Heartbleed but another installment coming on Thursday :-) ), and the bottom line is that by necessity, IR is gradually becoming part and parcel of a good security strategy.
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/22/2014 | 10:27:37 AM
Let's Talk About Response In Addition To Defense
Attackers have the advantage: they only need to find one flaw to get a beachhead, while the defenders have to be perfect all the time. It seems like the security industry is starting to put more emphasis on how organizations respond to an incident, instead of going for the impossible standard of perfect security. It's important to have a robust defense, but just like companies have DR/BC plans, they also need to have breach response plans in place.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/22/2014 | 10:00:13 AM
Re: Phish vs. Use of Credentials
@Robert. I agree with your multifactor authentication. Also, now that biometrics is increasing in popularity, what are the breach trends in accordance with this type multi-factor setup. (Biometrics & Hardcode passwords) My organization doesn't use biometrics and I am unsure how many organizations do but I am curious to see what difficulties they are facing in this space.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/22/2014 | 8:22:24 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Absolutely, Tim. There is a lot to the report, as always. Even more so this year with the broader and more global input. This year's report is a truly global and comprehensive look at what's really happening in data breaches as well as other security incidents. As always, we'll be drawing from its findings all year long. 

 
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
4/22/2014 | 8:10:41 AM
The Verizon Data Breach Investigations Report bears a close look
Great story from Kelly Jackson Higgins, but if you can make the time, it's worth reading the entire Verizon DBIR from beginning to end. The DBIR is one of the most interesting security studies released each year because it is not a survey -- it's data collected from actual breaches that Verizon and partners have investigated in the past year.

Surveys are great, but in security sometimes respondents don't give all the details of their posture, or simply don't know what they don't know. The DBIR shows the actual reasons behind major security breaches, how they occurred, and what their impact was. It's a great benchmark for the industry, and sometimes brings our flaws or faulty practices that enterprises have overlooked.
Page 1 / 2   >   >>


Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11509
PUBLISHED: 2020-04-07
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
CVE-2020-6647
PUBLISHED: 2020-04-07
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
CVE-2020-9286
PUBLISHED: 2020-04-07
An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system.
CVE-2020-11508
PUBLISHED: 2020-04-07
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action.
CVE-2013-7488
PUBLISHED: 2020-04-07
perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input.