WatchGuard AuthPoint the MFA Solution to Passwords
Near the end of 2020, it was revealed that cybersecurity firm FireEye was breached in a sophisticated cyberattack. We later learned the attack on FireEye originated from a prior intrusion on the billion-dollar IT solutions company SolarWinds. SolarWinds wasn’t a household name outside of IT circles but the company does have over 2,700 employees and provides enterprise software and software services to government agencies such as the U.S. Department of Energy, the U.S. Commerce Department, and the U.S. Treasury along with companies such as Microsoft, Cisco, VMware, and FireEye. Leading up to the SolarWinds breach, Vinoth Kumar, a security researcher, discovered clear text FTP credentials on a public GitHub repository. Passwords to the SolarWinds update server were now circulating and widely available. SolarWinds responded and fixed the issue but their lax security in handling of credentials along with enforcing strong/unique credentials was apparent — the leaked password to their update server was ‘solarwinds123.’
The SolarWinds example highlights many of the security issues faced due to human nature. The trouble with passwords is that they are easily guessed through brute force or social engineering. And guessing passwords through social engineering or phishing is often easier today than brute force. It’s obvious that the SolarWinds password would meet a 12 character length requirement and basic alphanumeric requirements but would still be easy to guess even if it had not been leaked. The leak is a separate vulnerability. Strong passwords are not enough to protect networks and endpoints but no password requirements can protect against poor password management controls. Storing passwords in plain text on an FTP server was simply asking for trouble. We all know strong and unique passwords are difficult to remember. And when you add in password expiration requirements, some form of password management system generally improves security along with overall usability and access. But no password management system should store passwords in plain text. All password managers need to use strong encryption such as AES 256-bit to nearly eliminate the potential of the cipher being cracked.
Most employees are not intentionally trying to compromise company security; however, you should ask yourself what password practices they now use to cope with the proliferation of online accounts requiring passwords. According to an often-quoted study by Microsoft Research, “The average user has 6.5 passwords, each of which is shared across 3.9 different sites. Each user has about 25 accounts that require passwords, and types an average of 8 passwords per day.” Insecure password practices are exploited in 81% of cyber attacks worldwide, and 61% of all attacks target businesses with less than 1,000 employees according to Verizon’s Data Breach Investigations Report. While employee education and training can help, what’s most needed to reverse this trend is for authentication to require additional proof of identity beyond simple username and password, and to be widely deployed by all companies – no matter their size. Only then, will cybercriminals no longer be able to use stolen or easily guessed credentials to access and infect your systems.
With billions of usernames and passwords widely available on the dark web and the dramatic increase in phishing attacks, credentials will remain easy for attackers to guess. In their 2021 Cybersecurity Predictions, WatchGuard predicts every service without multi-factor authentication will suffer a breach in 2021. Strong authentication is the cornerstone to good security. Multi-factor Authentication (MFA) remains the only true security measure available to fight against authentication attacks and WatchGuard AuthPoint provides the security you need to protect your assets, accounts and information.
AuthPoint is incredibly easy to use. Authentication is seamless through the mobile app and the cloud-based management is easy to deploy. Contact us today to find out how you can begin to work with the powerful protection of MFA to eliminate your #1 security risk.
