Verizon Breach Report Finds Poor Password Policies Allow Criminals Into Networks

Verizon has released its 2016 Data Breach Investigative Report (DBIR) that provides analysis of information security incidents in 2015. It pays particular attention to data breaches. In the recent of its annual DBIRs, the attackers appear to be staying a few steps ahead of the defenders and using tried and true methods to steal information.

In fact, the report stated “attackers have increased their efficiency to the point where they successfully compromise a network in less than a week to nearly 100% of the time.” Even worse, companies are only able to detect these intrusions 25% of the time. The Verizon Report breaks down the trend for the past decade in the following chart.

What are these cyber criminals after? Credentials for the most part. It may seem like an outdated objective, but the fact is, these types of attacks are still easy to conduct and are still extremely successful, especially when it comes to gaining access to corporate financial accounts.

In the report 63% of the confirmed breaches involved taking advantage of default, stolen, or weak passwords.  Many of the data breaches were due to the fact that the authentication method used is largely outdated. Criminals can get away with trying stolen credentials on targeted systems and run known exploits and be successful. The Verizon DBIR breaks down the studied breaches in the following chart:

Those who are responsible for networks should make extra efforts to not only add automated tools and software to their defensive line, but also to spend some time educating users on how create strong passwords and the importance of changing them regularly.

Put a password structure in place and enforce it. Strong passwords should always include at least eight characters, at least one special character, at least one number, and a combination of upper and lower case letters. They should never be dictionary words, contain sensitive data such as birthdates, or be any information that can be found on social media.

A policy should be in place to force users to change passwords on a regular schedule. This should be at least quarterly and should not allow them to reuse a password they have already used.

User names and passwords and strong policies on password use are a start to securing accounts. However, to help increase that 25% detection rate of the defenders, consider implementing two-step or multi-factor authentication. Anymore, it’s really not too much to ask users to enter an additional code to get access to accounts or networks, especially when the information they access is so valuable in the world of cybercrime. And when talking about access to corporate financial information and transactions, making sure there are at least two people who must approve any financial transaction is just a no brainer.

The report states the importance of empowering employees “to forge an additional, final line of defense against these types of human-targeted attacks.” After all, no one wants to be the one whose credentials are used by a criminal to do something nefarious. So, giving them the power to stop the behavior is only going to be beneficial.