{"id":24715,"date":"2018-09-14T11:00:22","date_gmt":"2018-09-14T10:00:22","guid":{"rendered":"http:\/\/www.intelligentcio.com\/eu\/?p=24715"},"modified":"2018-09-13T14:47:05","modified_gmt":"2018-09-13T13:47:05","slug":"new-security-research-reveals-password-inadequacy-a-top-threat","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2018\/09\/14\/new-security-research-reveals-password-inadequacy-a-top-threat\/","title":{"rendered":"New security research reveals password inadequacy a top threat"},"content":{"rendered":"

WatchGuard\u2019s Q2 2018 Internet Security Report uncovers cybercriminals\u2019 heightened use of credential-focused attacks, the continued prevalence of malicious Office documents, and more.<\/em><\/p>\n

WatchGuard Technologies<\/a>, a leader in advanced network security solutions, has announced the findings of its\u00a0Internet Security Report<\/a>\u00a0for Q2 2018<\/em>, which explores the latest security threats affecting small to midsize businesses (SMBs) and distributed enterprises.<\/p>\n

The new research from the WatchGuard Threat Lab revealed that 50% of government and military employee LinkedIn passwords were weak enough to be cracked in less than two days.<\/p>\n

This finding, along with the emergence of the Mimikatz credential-stealing malware as a top threat and the popularity of brute force login attacks against web applications, underscores the reality that passwords alone can\u2019t offer sufficient protection, and emphasises the need for multi-factor authentication (MFA) solutions in every organisation.<\/p>\n

\u201cAuthentication is the cornerstone of security and we\u2019re seeing overwhelming evidence of its critical importance in the common trend of password and credential focused threats throughout Q2 2018,\u201d said Corey Nachreiner, Chief Technology Officer at WatchGuard Technologies.<\/p>\n

\u201cWhether it\u2019s an evasive credential-stealing malware variant or a brute force login attack, cybercriminals are laser-focused on hacking passwords for easy access to restricted networks and sensitive data.<\/p>\n

\u201cAt WatchGuard, these trends are driving new innovative defences within our product portfolio, including\u00a0AuthPoint<\/a>, our cloud-based multi-factor authentication solution and our\u00a0IntelligentAV<\/a>\u00a0service, which leverages three malware detection engines to prevent malware strains that evade traditional signature-based antivirus products.<\/p>\n

\u201cEvery organisation should seek out vendor and solution provider partners that offer layered protection against these ever-evolving attack techniques.\u201d<\/p>\n

The insights, research and security best practices included in WatchGuard\u2019s quarterly Internet Security Report<\/em> are designed to help organisations of all sizes understand the current cybersecurity landscape and better protect themselves, their partners and customers from emerging security threats.<\/p>\n

The top takeaways from the Q2 2018 report include:<\/p>\n

Roughly half of government and military employee passwords are weak<\/strong><\/p>\n

After conducting a thorough analysis of the 2012 LinkedIn data dump to identify trends in user password strength, WatchGuard\u2019s Threat Lab team found that half of all passwords associated with \u2018.mil\u2019 and \u2018.gov\u2019 email address domains within the database were objectively weak.<\/p>\n

Of the 355,023 government and military account passwords within the database, 178,580 were cracked in under two days. The most common passwords used by these accounts included \u2018123456\u2019, \u2018password,\u2019 \u2018linkedin\u2019, \u2018sunshine\u2019 and \u2018111111\u2019.<\/p>\n

Conversely, the team found that just over 50% of civilian passwords were weak. These findings further illustrate the need for stronger passwords for everyone and a higher standard for security among public service employees that handle potentially sensitive information. In addition to better password training and processes, every organisation should deploy multi-factor authentication solutions to reduce the risk of a data breach.<\/p>\n

Mimikatz was the most prevalent malware variant in Q2<\/strong><\/p>\n

Representing 27.2% of the top 10 malware variants listed last quarter, Mimikatz is a well-known password and credential stealer that has been popular in past quarters but has never been the top strain.<\/p>\n

This surge in Mimikatz\u2019s dominance suggests that authentication attacks and credential theft are still major priorities for cybercriminals \u2013 another indicator that passwords alone are inadequate as a security control and should be fortified with MFA services that make hackers\u2019 lives harder by requiring additional authentication factors in order to successfully login and access the network.<\/p>\n