Leaked Credentials: The silent security threat
Leaked passwords are one of the leading causes of network intrusions today. Criminal gangs have become lazy and are looking for quick and easy money. Login details that can be found freely on the Darknet give them an open door to enter your network. That's why, on Change Your Password Day, we're talking about Leaked Credentials Monitoring.
What do you imagine when you think of a hacker who is busy doing his 'job'? Chances are you'll see a big screen, with a lot of Matrix-like green letters and numbers against a black background. Or you think of rattling keyboards on which a criminal tries to outsmart his prey. However, it is all much easier than that.
Phishing and leaked credentials go hand in hand
16% of today’s data breaches start with a successful phishing attack* . 15% start with leaked credentials* , which are login credentials that are freely available or for sale on the Darknet. Phishing cases result in an average cost of $4.76 million per case, while leaked credentials cost companies $4.62 million. If you know that a combined 1 in 3 hacks comes from one of these attack types, then you are looking at hefty sums for attacks that require little to no energy, time, or effort.
The most important, most efficient strategy to prevent your business from becoming a victim of leaked credentials or phishing is to have a strict password policy in place. That's what Change Your Password Day is all about: generating awareness so that it becomes clear that you need to update passwords regularly. And preferably (much) more often than once a year. The benefit of this far outweighs the temporary inconvenience of having to sort through your password database.
Of course, feel free to do the test yourself. There are several ways to find out exactly how big your security problem is in terms of leaked passwords. You can enlist the help of Secutec for this, but you can get started on your own as well.
HaveIbeenpwned is not a security strategy
Leaked credentials can be found today via the public website www.haveibeenpwned.com. It is a composite database of separate databases that are sent to the founders, or that are freely accessible on the Darknet. As an amateur researcher, you can use this to find out whether your data, or those of friends, colleagues and family, are up for grabs on the Darknet. A good start, but hardly enough to get a full overview of the situation.
There are many more and recent (paying) databases in circulation, to which a volunteer initiative such as HaveIbeenpwned does not have access. For that, you need professional resources. The tools that Secutec uses are specifically designed to find as many leaked data on the Darknet as possible.
An almost impossible task for an individual organization – terribly expensive too. However, for a company like Secutec it is feasible to collect all data at an affordable cost, since we do this for several companies at the same time. In short, anyone who limits himself to a regular check on HaveIbeenpwned, is attempting to secure a car with a bicycle lock.
Understanding password stealers
In addition, Secutec gets an overview of leaked domain-specific data (instead of just the data of one person). In our tool, for example, we can see when a company name appears multiple times in a data dump. If a platform has been hacked in its entirety, we get to see information from both the platform and all customers whose data were stolen. Moreover, these data are enriched with the devices from which they originate.
Secutec can then check which data comes from password stealers, that hide in their victim's browser, for example. Even more than the leaked data from platforms, these are the critical data that security departments have to watch out for. After all, these give direct access to all important accounts, platforms and security measures that the user has access to. Based on the information provided by Secutec, the IT department knows which devices need to be taken care of urgently.
How big is the problem?
When Secutec experts sit down with (potential) customers, the latter often shake their heads when confronted with the leaked data of certain employees. They probably saw this coming and it was already on their to-do list. But it is only when they are confronted in black and white with the state of affairs and the possible impact that they are actually shocked and take action.
That's how important it is to have up-to-date, detailed Security Intelligence. It almost has to go wrong before things change. And that is the strength of the Leaked Credentials module within Secutec SecureSIGHT. It's comparable to a comprehensive insurance: if everything goes well, you won't be bothered by it, but if there's that one scratch on the bodywork, you immediately have the certainty that something can be done.
This is how Secutec SecureSIGHT helps you
SecureSIGHT provides you with actionable data, enriched with all the information you receive from the other SecureSIGHT modules. It makes our service a unique offer that you will hardly find anywhere else in the world.
In addition to Leaked Credentials monitoring, Secutec SecureSIGHT also offers the possibility to perform ongoing vulnerability audits (ASM), and provides solutions for Active Managed Threat Hunting and Managed XDR.
Interested in how Secutec automates your exposure detection for you? Contact our cybersecurity experts for a demo.
*source: BM Cost of a Data Breach Report 2023