Weaknesses In Pasword Security?
Enterprise paswords are typically compromised due to
Use of Default Paswords – Many IT assets, especially devices, have a default pasword applied out of the box. End users are also often granted initial access to corporate systems through a pasword created by the IT team. Using these default credentials makes pasword compromise easy for cyberattackers
Creation of Weak Paswords – Paswords that are short and have limited character variety or are linked to the identity of the user (e.g., birthday combined with name of spouse) are easy to guess and therefore easy to compromise
Pasword Reuse – End users may create one pasword that is used across multiple services. Threat actors that obtain the pasword by compromising one service can now use the pasword to gain access to other services. The Colonial Pipeline attack in the USA, which resulted in fuel shortages, was made possible by pasword reuse
Pasword Recycling – End users may use older paswords again after an interval of time, allowing threat actors to enter the organisation through paswords that have been previously compromised
Pasword Sharing – Employees who are in the habit of sharing paswords amongst themselves increase the probability of an internal threat actor misusing the shared paswords, or selling the paswords to an external threat actor
Poor Pasword Storage – End users may store paswords in plain text files which may be exfiltrated by cyberattackers, or leave them written on their desks where they may be stolen by anyone with physical access to the desk
This may be considered a list of worst practices in the context of pasword security. Let us now understand how threat actors may obtain these paswords.