On Sept 5, 2018, law enforcement alerted Inova Health of a data breach. It appears that their billing systems were accessed by a bad actor using an employee\u2019s credentials first in January 2017, and then again, between July-October 2017. The breach has impacted 12,331 patients.<\/p>\n
An article by Databreaches.net<\/a> points rightly at the source of the problem- if Inova Health systems were being accessed repeatedly once in January then again in July-October with the same credentials, then neither did the employee change their password, nor did the system require that the employee should do so. <\/em><\/p>\n Password re-use can cripple even the most secure systems.<\/em><\/p>\n – Travis Smith, Tripwire<\/em><\/p><\/blockquote>\n Lori Macvitte of F5<\/em> writes<\/a> of a 2012 study done by CSID. The CSID researchers found that three-fifth of the Internet users reuse passwords on multiple sites. Some of the major password habits of American consumers are listed below:<\/p>\n <\/p>\n According to the National Institute of Standards and Technology (NIST), stolen or weak passwords were the real cause of more than 80% of hacking-related breaches<\/strong><\/a>.<\/p>\n Let’s consider the situations listed below:<\/p>\n Hey, but isn\u2019t 2012 ancient history?<\/em> Not really- \u00a0\u00a0<\/strong><\/p>\n Certainly, bad password habits aren\u2019t history. People still reuse passwords; and they still create easy-to-use passwords. <\/em><\/p>\n If your employees use their email addresses as username- it\u2019s a hack made easy. Consider the techniques listed below. Attackers can use them, and get corporate email addresses easily.<\/p>\n Now consider the techniques that criminals could use to collect passwords:<\/p>\n Else, they could just buy credentials from the dark-web, and hammer your network with password and login combinations. Consider the following new items:<\/p>\n Remember the 2012 LinkedIn incident? Attackers stole 6.5 million passwords from LinkedIn servers.<\/p>\n The two news items listed below aren\u2019t even a month old:<\/p>\n Both incidents are suspected to be credential stuffing attacks. A recently published report on credential stuffing underlines the problem. As per the report, Akamai customers were hammered by nearly 30 billion malicious login attempts<\/strong> between November 2017 and June 2018. That\u2019s 3.5 billion attempts a month.<\/p>\n Out of them, 8.3 billion<\/strong> were recorded between May and June, only.<\/p>\n Simply stating, credential stuffing is an automated attack on your network by a botnet which hammers your network with login credentials until a set of credentials is accepted as legitimate.<\/p>\n In essence, credential stuffing is just another brute force attack. Unfortunately, if either an employee, or customer, or partner has had bad password habits \u2013 they have reused passwords, or used weak or fairly common passwords \u2013 the attacker would gain access to your network.<\/p>\n In all the cases<\/a> stated above, attackers gained access to the victim website only because people had bad password habits.<\/p>\n <\/p>\n <\/p>\n As stated above, NIST has found stolen or weak passwords to be the cause of more than four-fifth, or 80% of hacking-related breaches. This makes password habits a major risk factor for your business.<\/p>\n \u00a0<\/strong><\/p>\n References<\/strong>:<\/p>\n On Sept 5, 2018, law enforcement alerted Inova Health of a data breach. It appears that their billing systems were accessed by a bad actor using an employee\u2019s credentials first in January 2017, and then again, between July-October 2017. The breach has impacted 12,331 patients. An article by Databreaches.net points rightly at the source of […]<\/p>\n","protected":false},"author":3,"featured_media":3740,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[177,181,163,175,178,184,179,182,183,180],"class_list":["post-2499","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infosec","tag-credential-stuffing","tag-csid","tag-data-breach","tag-nist","tag-owasp","tag-password-habits","tag-password-management-system","tag-password-policy","tag-password-protection","tag-steganography"],"_links":{"self":[{"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/posts\/2499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/comments?post=2499"}],"version-history":[{"count":0,"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/posts\/2499\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/media\/3740"}],"wp:attachment":[{"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/media?parent=2499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/categories?post=2499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.empowerelearning.com\/blog\/wp-json\/wp\/v2\/tags?post=2499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Why should the Inova Health breach concern you?<\/strong><\/h3>\n
\n
How bad password habits hurt your business?<\/strong><\/h3>\n
\n
\n
How hackers steal passwords and usernames?<\/strong><\/h3>\n
\n
\n
\n
Do brute force attacks really work? <\/strong><\/h3>\n
\n
What is credential stuffing?<\/strong><\/h3>\n
Bad password habits and credential stuffing<\/strong><\/h3>\n
Consider the examples shared on the OWASP website<\/strong><\/h4>\n
\n
The DOs and DON\u2019Ts of password security<\/strong><\/h3>\n
\n
Create strong passwords<\/strong><\/h4>\n<\/li>\n<\/ol>\n
\n
\n
\n
Avoid risky password practices <\/strong><\/h4>\n<\/li>\n<\/ol>\n
\n
\n
Good password management practices<\/strong><\/h4>\n<\/li>\n<\/ol>\n
\n
\n