Prevent Account Takeover with Better Password Security

Tom is effective for a respected money institution. He has a lengthy, sophisticated password that would be in the vicinity of-difficult to guess. He’s memorized it by coronary heart, so he began working with it for his social media accounts and on his own equipment too. Unbeknownst to Tom, just one of these websites has had its password database compromised by hackers and put it up for sale on the dark web. Now menace actors are operating really hard to hyperlink these leaked credentials back to actual-life men and women and their sites of operate. In advance of extended, a threat actor will use Tom’s authentic email account to mail a spear-phishing connection to his CEO.

This is a typical account takeover state of affairs exactly where malicious attackers obtain unauthorized accessibility to the organization’s methods, placing critical data and functions at risk. It typically starts off with compromised qualifications. We’ll operate by way of why account takeover is so tough to end once it commences and why powerful password security is the very best prevention.

Why are account takeover attacks so unsafe?

Gaining entry to an Lively Listing account inside an business is a desire situation for a hacker. They can launch social engineering attacks from a genuine related email account or instant messaging service, communicating with other staff from a reliable account that will never be flagged by internal security. If the phishing messages are thoroughly crafted, it could be some time just before the impersonation is learned.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Attackers could just take in excess of an account with present privileges or compromise a stale or inactive account and attempt to elevate their privileges from there. This can give them the keys to all fashion of delicate information shared inside the organization, these as private company plans, money facts, intellectual property, or individually identifiable facts (PII) of staff or customers. The legitimacy of the compromised account will increase the probabilities of achievements in these fraudulent routines.

Because these attacks entail the use of genuine user qualifications it is challenging to distinguish concerning authorized and unauthorized accessibility. Attackers generally mimic the habits of respectable people, earning it more durable to discover suspicious functions or anomalies. End users may well not be mindful that their accounts have been compromised, primarily if the attackers manage accessibility without boosting suspicion. This hold off in detection lets attackers to carry on their malicious routines, raising the likely harm and creating remediation a lot more demanding.

Interested to know how lots of stale and inactive accounts are in your Energetic Directory setting alongside with other password vulnerabilities? Operate this free go through-only password audit.

Actual-daily life illustration: U.S. Point out Authorities breach

A new security incident in an unnamed U.S. Condition Authorities firm highlighted the potential risks of account takeover. A danger actor properly authenticated into an interior digital personal network (VPN) accessibility stage making use of an ex-employee’s leaked credentials. After inside of the network, the attacker accessed a digital equipment and blended in with legit website traffic to evade detection. The compromised virtual equipment provided the attacker with obtain to a different established of qualifications with administrative privileges to each the on-premises network and Azure Energetic Directory.

With these qualifications, the danger actor explored the victim’s surroundings, executed lightweight directory access protocol (LDAP) queries towards a area controller, and attained accessibility to host and person information and facts. The attackers then posted the breached info on the dark web, intending to market it for monetary obtain.

How weak and compromised passwords direct to account takeover

Negative password security practices can noticeably maximize the risk of account takeover. Using weak passwords that are effortless to guess or crack will make it pretty very simple for attackers to compromise accounts. Finish consumers choose frequent root phrases and then insert particular characters with uncomplicated structures to meet up with complexity prerequisites like “password123!”. These will be swiftly guessed by automatic brute pressure methods utilised by hackers.

A relating to selection of organizations still have password procedures that allow for weak passwords which are large open up to account takeover. Even so, it truly is critical to try to remember potent passwords can turn into compromised too.

Password reuse is typically missed but is 1 of the riskiest end-person behaviors. When people reuse the same password (even if it really is a powerful 1) throughout many accounts, a breach in a person support can expose their qualifications, producing it less complicated for attackers to gain accessibility to other accounts. If a cybercriminal obtains a user’s password from a compromised web site, they can test employing it to obtain unauthorized accessibility to their function accounts.

Improve password security to stop account takeover

Much better password security plays a crucial job in preventing account takeover attacks. Utilizing MFA adds an extra layer of security by requiring consumers to provide added verification factors, these kinds of as a a person-time password, biometric facts, or a actual physical token, in addition to their password. Even so, MFA just isn’t infallible and can be bypassed. Weak and compromised passwords are nevertheless pretty much generally the commencing point for account takeover.

Imposing advanced password specifications, this kind of as a bare minimum size of 15 figures, a mix of uppercase and lowercase letters, quantities, and exclusive characters, can make it tougher for attackers to guess or crack passwords by way of brute-power or dictionary attacks.

Having said that, your firm also requirements a way to detect passwords that may have grow to be compromised by means of dangerous habits these types of as password reuse. A tool like Specops Password Plan repeatedly scans your Active Directory atmosphere against an at any time-increasing list of more than 4 billion compromised passwords. If an stop person if found to be using a breached password, they’re compelled to modify it and close off a opportunity attack takeover route.

Want to see how Specops Password Policy could in good shape in with your corporation? Discuss to us and we can set up a free of charge trial.

Uncovered this post fascinating? This post is a contributed piece from a single of our valued companions. Adhere to us on Twitter  and LinkedIn to go through much more exceptional content material we post.