Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
![Validate Whether the Credentials Belong to Current Employees
Underground markets are awash in employee credentials -- usernames and associated passwords and usernames alone. The study that Digital Shadows conducted, for instance, found that food and beverage organizations on average had over 87,350 credentials exposed; education and technology organizations had an average of around 48,000 employee credentials available online.
But not all of them pose a risk. If the user has left the organization, it's unlikely that his credentials would be active. Similarly, if a password does not match the current password format, it's unlikely that an attacker could use it to gain access to internal systems. Asking these questions is fundamental to ensuring the security team doesn't end up resetting passwords that no longer present a threat, Marriott says.
'Security teams may have their own scripts to look to validate credentials and assess whether they meet the password or email format,' he says. 'Alternatively, the rise of security orchestration, automation, and response [SOAR] platforms provides additional ways for teams to automate these actions.'
Image Source: NicoElNino via Shutterstock](https://img.deusm.com/darkreading/1338800/2.jpg)
Underground markets are awash in employee credentials -- usernames and associated passwords and usernames alone. The study that Digital Shadows conducted, for instance, found that food and beverage organizations on average had over 87,350 credentials exposed; education and technology organizations had an average of around 48,000 employee credentials available online.
But not all of them pose a risk. If the user has left the organization, it's unlikely that his credentials would be active. Similarly, if a password does not match the current password format, it's unlikely that an attacker could use it to gain access to internal systems. Asking these questions is fundamental to ensuring the security team doesn't end up resetting passwords that no longer present a threat, Marriott says.
"Security teams may have their own scripts to look to validate credentials and assess whether they meet the password or email format," he says. "Alternatively, the rise of security orchestration, automation, and response [SOAR] platforms provides additional ways for teams to automate these actions."
Image Source: NicoElNino via Shutterstock
2021 Top Enterprise IT TrendsWe've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Tweet This
0 Comments
