Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Stolen Passwords Used In Most Data Breaches
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
ChrisB093
ChrisB093,
 User Rank: Strategist
4/24/2014 | 9:47:52 AM
Solutions to stop credentials-based-attack
Despite the widespread occurance and high profile too many corporations are not doing enough to mitigate the risk of security breaches from password based attacks.

Such an attacker is likely to log in with stolen credentials from an abnormal location at an unusual time. Restricting user's individual access to the network by physical location (workstation or device, IP range, department, floor, building...) and setting usage/connection time limits helps organizations avoid these credentials-based attacks.

In addition by preventing concurrent logins network vulnerability is significantly reduced. This limits users to only one possible connection at any one instant making it impossible for any rogue user to use valid credentials at the same time as their legitimate owner, wherever they are based.

Our solution UserLock ensures unauthorized access is no longer possible for Windows based infrastructures - even when credentials are compromised. It stops malicious users seamlessly using valid credentials. 

We blog further about internal security breaches from password based attacks here: http://www.isdecisions.com/blog/it-security/internal-security-breaches-from-password-based-attacks/
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
4/23/2014 | 6:00:25 PM
Re: Supplement Security With Access Analytics
Thanks so much for sharing your insight and experience with this @douglasmow. What seems to be such a basic thing to secure and track, a logon & password, always seems to rear its ugly head. The Verizon DBIR put an exclamation point on it, that's for sure. 
douglasmow
douglasmow,
 User Rank: Apprentice
4/23/2014 | 4:51:46 PM
Supplement Security With Access Analytics
@Kelly, Your story covering the 2014 Verizon DBIR highlights something we work to continuously convey to customers... what may look like a customer or partner or staff member, may not in fact be so. With the report citing 2 out of 3 data breaches are from stolen credentials, organizations with insight into who is accessing what information for what purpose will be able to better detect, deter and possibly even prevent a breach. The only way to gain this insight is by applying analytics to the big data of identity and access. By analyzing user access rights and the associated risk on a continuous basis, organizations can identify suspicious behavior patterns to expose external, as well as internal, threats of inappropriate access.

 

@Robert, agree fortifying perimeter defense is critical but security can be enhanced by knowing who should be accessing what once a user, legitimate or not, is inside.

 
Markus5
Markus5,
 User Rank: Strategist
4/23/2014 | 6:09:44 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Isn't it time for everyone to start using a password management system? I use Sticky Password, but there are many others out there.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
4/22/2014 | 11:51:48 AM
Re: The Verizon Data Breach Investigations Report bears a close look
In case you missed the link to the full report in Kelly's news story, you can get all the details here. 
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
4/22/2014 | 10:31:04 AM
Re: Let's Talk About Response In Addition To Defense
Totally agree, @Drew Conry-Murray. I've been writing a series on IR's role in security (was on hold for  Heartbleed but another installment coming on Thursday :-) ), and the bottom line is that by necessity, IR is gradually becoming part and parcel of a good security strategy.
Drew Conry-Murray
Drew Conry-Murray,
 User Rank: Ninja
4/22/2014 | 10:27:37 AM
Let's Talk About Response In Addition To Defense
Attackers have the advantage: they only need to find one flaw to get a beachhead, while the defenders have to be perfect all the time. It seems like the security industry is starting to put more emphasis on how organizations respond to an incident, instead of going for the impossible standard of perfect security. It's important to have a robust defense, but just like companies have DR/BC plans, they also need to have breach response plans in place.
RyanSepe
RyanSepe,
 User Rank: Ninja
4/22/2014 | 10:00:13 AM
Re: Phish vs. Use of Credentials
@Robert. I agree with your multifactor authentication. Also, now that biometrics is increasing in popularity, what are the breach trends in accordance with this type multi-factor setup. (Biometrics & Hardcode passwords) My organization doesn't use biometrics and I am unsure how many organizations do but I am curious to see what difficulties they are facing in this space.
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
4/22/2014 | 8:22:24 AM
Re: The Verizon Data Breach Investigations Report bears a close look
Absolutely, Tim. There is a lot to the report, as always. Even more so this year with the broader and more global input. This year's report is a truly global and comprehensive look at what's really happening in data breaches as well as other security incidents. As always, we'll be drawing from its findings all year long. 

 
DarkReadingTim
DarkReadingTim,
 User Rank: Strategist
4/22/2014 | 8:10:41 AM
The Verizon Data Breach Investigations Report bears a close look
Great story from Kelly Jackson Higgins, but if you can make the time, it's worth reading the entire Verizon DBIR from beginning to end. The DBIR is one of the most interesting security studies released each year because it is not a survey -- it's data collected from actual breaches that Verizon and partners have investigated in the past year.

Surveys are great, but in security sometimes respondents don't give all the details of their posture, or simply don't know what they don't know. The DBIR shows the actual reasons behind major security breaches, how they occurred, and what their impact was. It's a great benchmark for the industry, and sometimes brings our flaws or faulty practices that enterprises have overlooked.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-45786
PUBLISHED: 2023-02-04
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition ...
CVE-2023-22849
PUBLISHED: 2023-02-04
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling Ap...
CVE-2023-25193
PUBLISHED: 2023-02-04
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVE-2023-0676
PUBLISHED: 2023-02-04
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
CVE-2023-0677
PUBLISHED: 2023-02-04
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.