Reality Check: How Adversaries Use Unsecured Passwords to Crack into Enterprise Systems



By: Mohie Ahmed

Weak passwords have long been the Achilles heel of IT teams, and despite all the best intentions, corporate policies, education, and workarounds, passwords aren’t going away any time soon. There is some buzz around password-less access, but there are good arguments to suggest that passwords should play a fundamental role in authenticating access.

While biometric data, facial and fingerprint scanning will improve security in the future, passwords are personal and portable and cannot be taken away – unless those passwords are easily guessed.

It is the combination of passwords and multi-factor authentication (including bio-related) that can dramatically reduce the odds of having an infrastructure taken over or assets stolen. 

Passwords continue to get the most press when it comes to hacks, whether those passwords are shared accidentally or intentionally, or stolen. Until advanced access technologies (iris scanning, facial recognition, voice biometrics, fingerprint, etc.) are affordable and manageable, for the foreseeable future, passwords are here to stay.

For end-users, they are easy (or should be). However, that simplicity combined with ubiquity is what makes passwords attractive to cybercriminals, who have multiple approaches, including these top five:

  1. Phishing, a social engineering trick which attempts to trick users into supplying their credentials to what they believe is a genuine request from a legitimate site or vendor.
  2. Credential Stuffing or testing databases or lists of stolen credentials against multiple accounts to find a match.
  3. Password Spraying, using a list of commonly used passwords against a user account name, such as 123456, ABCDEF, password, password123 and birthdays, telephone numbers, and other commonly created passwords.
  4. Keylogging, which records the strokes typed on a keyboard and has been used to tunnel into bank accounts, digital wallets, eCommerce accounts, and more.
  5. Targeted, manual “brute force,” which is often used to attack individuals were guessing their passwords is made easier based on their social media activity, relationships, and more.

Modern password management will protect organizations and the individuals in those organizations by providing suggested passwords that are held in a vault and changed as necessary, with automation that makes this invisible to the user and less time consuming for IT analysts.

The best way to avoid breaches due to password hacks is to identify and eliminate unsecured passwords, which, according to Verizon’s DBIR 2020 report, are still the main entry point for cybercriminals.

A strong password management tool like Ironsphere’s Dynamic Password Controller can provide granular access control to help prevent password-related data breaches from occurring.

The Dynamic Password Controller is a password vault that stores and rotates SSH keys and passwords of privileged accounts (admin, system, root, etc.) centrally and securely.

Authorized users log in with their personal accounts, check-out the credential of a privileged account, and then use it to connect to target endpoints. The Dynamic Password Controller generates searchable log records and audit trails to meet security and compliance requirements.

Our solution works with Windows, Linux, and Unix, with Oracle, PostgreSQL, MsSQL, and other databases, and interoperates with all devices and applications with a CLI interface and applications with a password change API.

Contact us to learn more about how your organization can eliminate unsecured passwords and protect your data, applications, and infrastructure.

Similar Blogs

Mitigating Risks of Root Access for Superusers

Mitigating Risks of Root Access for Superusers

Depending on the nature of their work, IT superusers have or need root access to be efficient and productive. Creating a team of superusers makes sense, especially for large organizations, with thousands of servers under management. With a well-managed sysadmin team, their work can be streamlined, and mistakes can be reduced when the team shares the same root accounts on all servers.

read more
Decentralized PAM Advantages and Challenges: Keeping Organizations Secure from Edge to Cloud

Decentralized PAM Advantages and Challenges: Keeping Organizations Secure from Edge to Cloud

The debate on centralized vs. decentralized IT has been going on for decades, and there are solid arguments for both choices. The rise of the cloud changed everything, and today “shadow IT” continues to challenge CIOs and CISOs who are charged with protecting the assets of their organizations while also not restricting the number of productivity tools available which employees and contractors continue to find and use rather than using “official” applications.

read more