Security experts share insights on keeping passwords safe : @VMblog

Some of the most infamous data breaches in
modern history, such as the Colonial Pipeline, can be attributed to stolen
credentials or passwords. This year’s World Password Day emphasizes the
significance of establishing robust, continuous security policies. To
commemorate the day, various cybersecurity experts have gathered to offer
important advice on what you can do to avoid having your passwords become one
of the 15 billion accessible on the Dark Web.

Patrick
Beggs, CISO, ConnectWise

“In the early days of the world wide web, you were
probably able to get away with a password as simple as ‘12345′. Times have
changed since then, but humans remain predictable. Research
has found that women typically include personal names in their passwords while
men often use their hobbies. And experienced hackers also know the common
vowels, numbers, and symbols that often appear in passwords.

Cybersecurity breaches are at an all-time high, but
there are three simple things we can all do to protect ourselves. First,
prioritize length over complexity, because we aren’t very good at remembering
complex passwords, and longer ones are more secure. Second, only use platforms
with multi-factor authentication — a password alone is not enough to protect
you. And finally, never reuse. Most breaches happen when a password from one
platform is used with another system that shares the same password.

If you follow these three simple steps, your
passwords should be strong enough to stop a determined hacker from causing
damage.”

Tyler
Farrar, CISO, Exabeam

“Colonial Pipeline and Twitch. Both of
these organizations have one thing in common: they suffered data breaches as a
result of stolen passwords and credentials. Credential theft has become one of
the most common and effective methods cyber threat actors use to infiltrate
organizations of all sizes and access sensitive data.

We strongly support efforts, like World
Password Day, that raise public awareness and can help to combat this pervasive
issue. We advocate for the best practices that ensure cyber hygiene and protect
personal and professional passwords and credentials to prevent credential-based
attacks from continuing.

Credential-driven attacks are largely
exacerbated by a ‘set it and forget it’ approach to credential management, but
organizations must build a security stack that is consistently monitoring for
potential compromise. Organizations across industries can invest in data-driven
behavioral analytics solutions to help detect malicious activity. These
analytics tools can immediately flag when a legitimate user account is
exhibiting anomalous behavior indicative of credential theft, providing greater
insights to SOC analysts about both the compromised and the malicious user,
which results in a faster response time.”

Neil
Jones, director of cybersecurity evangelism, Egnyte

“For
as long as I can remember, easily-guessed passwords such as 123456, qwerty, and
password have dominated the global listing of most commonly-used passwords.
Unfortunately, weak passwords can become a literal playground for
cyber-attackers, particularly when they gain access to your organization’s
remote access solution and can view corporate users’ ID details.

Similarly,
not a day goes by where I don’t hear another customer in a public setting like
a pharmacy or a supermarket vocally share his/her email address and/or personal
or business phone number, to obtain affinity club credit for a transaction or
to earn a discount. That private contact information – combined with weak
password administration – can represent a data breach just waiting to happen.

In
commemoration of World Password Day, here are practical tips to protect your
company’s mission-critical data:

• Institute Multi-Factor
  Authentication (MFA) – One of the most effective ways to prevent unauthorized
  access is by requiring additional validation of login credentials during a
  user’s authentication process. This can be as straightforward as a user
  providing his/her password, then entering an accompanying numeric code from an
  SMS text. 

• Educate your employees on
  password safety – Educate your users that frequently-guessed passwords such as 123456,
  password, and their favorite pets’ names can put your company’s data and their
  personal reputations at risk. Reinforce that message, by reminding users that
  passwords should never be shared with anyone, including your IT team.

• Inform users about the
  dangers of social engineering and spear-phishing – Remind users that unanticipated email messages, texts, and phone
  calls can be attempts to capture their login and password credentials. When
  proper login credentials are entered, malware can be initiated that will place
  your organization at risk of an even wider and more destructive cyber-attack.

• Keep personal and business
  contact information separate – Remind your
  users that maintaining separate email accounts and contact details for affinity
  clubs and discount programs protects their personal privacy and your company’s
  valuable data. Users should never provide business login credentials (such as
  their email addresses) in public forums, particularly within earshot of others.

• Establish mandatory
  password rotations – Discourage the usage of system default passwords and easily-guessable
  employee credentials, by forcing employees to change their passwords on a
  routine basis.

• Update your account
  lockout requirements – Prevent brute force password attacks, by immediately
  disabling users’ access after multiple failed login attempts.”
  

Gunnar Peterson, CISO, Forter

“It is
especially fitting that we collectively celebrate World Password Day in light
of recent breaches this quarter that have resulted in terabytes of stolen
proprietary data and untold financial cost. The day is a reminder that the
simplest of defenses in our toolbelt, credential and identity management, can
be the difference between a secure system or an unimaginable incident.

Most of the
breaches we hear about in the news are a result of businesses relying on
automated access control and realizing too late when a user has been hijacked.
Once an account is compromised, identity-based fraud can be extremely difficult
to detect considering the advanced tactics and randomness of different crime
groups like LAPUS$ and Conti.

To succeed
against dynamic cybercriminals and account takeover (ATO) attacks,
organizations must build robust identity management systems and invest
resources into building a learning system that evolves to identify anomalous
user activity. These techniques can ebb and flow with the sophisticated threat
landscape we’re witnessing today.”

Aaron
Sandeen, CEO and co-founder, Cyber Security Works
(CSW)

“World Password Day is a day set aside not just to
promote better password use, but to draw attention to the numerous
password-related assaults. Tackling every password-related attack would be
difficult, but addressing the problem of Password Reset Poisoning plays an
important role in increasing organizational knowledge about better password use
and vulnerability management.

Every online application with a login gateway has
password reset capabilities. When a user forgets his password, this reset
password option is useful. However, in many organizations, password reset
poisoning is an attack in which the attacker obtains a victim’s password reset
token and is now able to reset the victim’s password. The problem occurs when
the program uses the host header to create the password reset link and then
adds the user-supplied host header to the password reset link. It is crucial
for companies to inform themselves of this type of password attack to protect
the privacy of their employees and the business as a whole. While addressing
similar password-related attacks, more vulnerabilities can be addressed and
give security teams peace of mind.”

Surya
Varanasi, CTO of StorCentric

“Few would argue the fact that a strong password is
an ideal first line of data protection defense. Without this basic security
measure, you are leaving the door wide open to a multitude of cybercrime risks.
Unfortunately, however, while highly sophisticated password tools are
available, today’s cyber criminals also have extremely advanced password
hacking technology at their fingertips. Which means, an increased risk of your
passwords being leapfrogged, and your data being compromised.

The ideal cybercrime defense is a layered defense
that starts with a powerful password and continues with Unbreakable Backup. As
backup has become today’s cyber criminals’ first target via ransomware and
other malware, an Unbreakable Backup solution can provide you with two of the
most difficult hurdles for cyber criminals to overcome – immutable snapshots
and object locking. Immutable snapshots are by default, write-once read-many
(WORM) but now some vendors have added features like encryption where the
encryption keys are in an entirely different location than the data backup
copy(ies). And then to further fortify the backup and thwart would be
criminals, with object locking layered on top of that, data cannot be deleted
or overwritten for a fixed time period, or even indefinitely.”

JG
Heithcock, GM of Retrospect, a StorCentric Company

“Ransomware is a huge global threat to businesses
around the world. Beyond the high-profile attacks, including Colonial Pipeline,
JBS, Garmin, and Acer, many people now personally know a colleague whose
business was attacked. In fact, a Coveware research study revealed that most
corporate targets are small and medium businesses (SMBs), with 72% of targeted
businesses having fewer than 1,000 employees, and 37% fewer than 100.

There are likely a few reasons for this continuing
trend. Certainly, one is that today’s ransomware is attacking widely, rapidly,
aggressively and randomly – especially with ransomware as a service (RaaS)
becoming increasingly prevalent – looking for any possible weakness in defense.
Another is that SMBs do not typically have the technology or manpower budget as
their enterprise counterparts, leaving them more vulnerable targets.

It is therefore critical that in addition to powerful
passwords, which anyone would agree is an indispensable first line of defense,
there must be additional measures taken. The first is that all organizations
regardless of size must be able to detect anomalies as early as possible to
remediate affected resources. The next is SMBs and large enterprises alike need
a backup target that allows them to lock backups for a designated time period.
Many of the major cloud providers now support object locking, also referred to
as Write-Once-Read-Many (WORM) storage or immutable storage. Users can mark
objects as locked for a designated period of time, preventing them from being
deleted or altered by any user – including internal bad actors.”

John Gunn, CEO, Token

“World
Password Day is akin to National Running with Scissors Day, both
activities are inherently unsafe, with the latter being significantly
safer based on a statistical analysis. The security of passwords, or
lack thereof, has advanced only marginally over the sixty-one years
since they were first implemented. It’s time for us to collectively
change the name of the day to World Passwordless Day and commit to
eliminating passwords entirely.”
 
Dave Cundiff, CISO, Cyvatar
 
“As
it has become apparent through the years that passwords alone would not
be sufficient to protect users and their data, multiple technologies
have emerged. One of the most ubiquitous and easiest to implement these
days is multi-Factor authentication. Before mobile technology became so
widespread, MFA was enabled by hardware tokens you purchased from a
company and either entered a code or scanned a key or inserted a USB.
Now it can be as easy as having a code emailed to a different email
address or texted to your smart phone. This vastly improves the chances
of a user to not have their credentials compromised by eliminating the
single point of failure, the password.
 
Further, we have
additionally evolved to multiple biometric solutions such as fingerprint
scanners, facial recognition, and even keyboard/mouse biometric models.
A number of organizations require these types of security in addition
to passwords to provide a greater reliability. Biometric continuous
authentication systems like keyboard models monitor the typing styles of
the user and build a sophisticated model of how the user interacts with
their keyboard, what their typing style or cadence is and other data
points to be able to discern very quickly a difference between the
actual user and someone else. These methods will continue to improve in
reliability and accuracy as we move forward, hopefully one day making
the need for passwords as unnecessary as the early days of my childhood
playing games like Zork.”
 
Ismet Geri, CEO, Veridium
 
“Do you want to eliminate 80% of cybers attacks? Then kill the password.
 
We
all have heard about Colonial Pipeline attack that took down one of the
largest fuel pipelines in the US and the T-Mobile
millions of customers data breach, just to name a few of them. All these
attacks have in common the use of compromised credentials. Compromised
passwords have been the root cause of 80% of these attacks. Google have
warned that billions of passwords are available in the dark web,
probably your passwords are already in use.
 
Authentication is
the fundamental cornerstone for everything happening in our digital
world, would this be connecting to our social medias, login into our
enterprise applications, making online purchase, executing financial
transactions, …We have been dependent on shared secrets for
authentication for many decades, we have been dependent for too long
time on the shortcoming of passwords.
 
This must change now! Our
digital society can’t rely anymore on passwords, on share secrets.
Technologies for passwordless multifactor authentication are now robust,
resilient, and well tested. Smartphones, desktops used in combination
with biometrics such as fingerprint, facial recognition and behavioral
analytics can be used to both onboard and authentication users.”

Monti Knode, Director of Customer Success, Horizon3.ai

“The
movies typically frame hackers as underground, terrifying,
sneak-into-your-home types of criminals, but that’s not really the case.
The fact of the matter is that most attackers don’t hack in; they log
in. The password pandemic that plagues the technology world today is
rampant, but definitely fixable. How?

• First: take
  control. Having weak or default passwords such as ‘adminadmin’,
  ‘password1’ or even ‘P@$$w0rD’ leaves you with your pants around your
  ankles – exposed.
• Second, don’t reuse your passwords. Having one
  singular password for everything means that if one is successful or
  cracked, an attacker will attempt to reuse it and then your entire
  foundation comes crumbling down around you.
• Finally,
  aggressively seek out your weaknesses. One way to do this is autonomous
  pentesting. By continuously searching your network for paths and
  openings, you are proactively fighting against attackers.

Be your own hero this World Password Day by protecting your ‘crown jewels’.”

Lance Spitzner, Director of Security Awareness, SANS Institute

“Even
if you have the longest, most secure password in the world, if that
password is compromised cyber attackers have full access to your
account, system, and data. One of the most effective and proven
approaches for strong authentication is something called Multi-Factor
Authentication, or MFA. This way, if your password is compromised, your
account, system, and data are still safe as the other factor or factors
still protect you. MFA can include:

1. A one-time, unique code is
   sent to your mobile device via SMS text that is then used along with
   your password to authenticate and log-in.
2. An authentication
   mobile app (such as Google Authenticator) that generates the unique
   one-time codes for you. You download the mobile app to your mobile
   device, then to enable MFA for your accounts you sync the authentication
   app with each account. Some mobile authentication apps (like
   Microsoft’s Authenticator) also make it so that when you log into
   certain websites, instead of requiring a one-time use code, the website
   pushes an authentication request to your mobile app asking if that is
   you trying to log in.
3. A physical device that connects to your
   laptop or computer and is registered with the websites you regularly log
   into. When the device is connected to your computer (via the USB port
   or connected via NFC technology) and you visit these websites, the
   device authenticates you.”

##