We all know that data breaches have leaked billions of user credentials (usernames and passwords) on the public internet and dark web. The Global Password Security Report shows an alarming 50% of people reuse the same passwords across their personal and work accounts. If a cybercriminal obtains legitimate credentials for a personal account, they often can also get into that person’s work account because of this password reuse. As a result, compromised credentials are a threat to many other sites, not just the organization that had the data breach. Organizations need to mitigate credential stuffing.
Once the user name and passwords combinations for users are exposed, cybercriminals can leverage that data in various ways. Here are the most common:
There are various ways for organizations to prevent credential stuffing attacks, but none are entirely 100% reliable in all cases. Here are the eight ways to mitigate credential stuffing
Here are the pros and cons of each method.
LastPass can be used for individual usage, or employees can use it within an organization. LastPass securely stores usernames and passwords, so users don’t have to remember them. They only need to remember one master password (which they should never use anywhere else). Now that users don’t have to remember their passwords, they can create random, strong passwords, and never reuse them. With over 13.5 million customers and 47,000 business enterprise clients, LastPass enables ease-of-use while maintaining high security when it comes to passwords.
For example, an online retailer cannot force its customers to use a password manager to log in to their website. In these cases where a password manager cannot be used, we recommend a layered approach with the following options during user or customer authentication.
This requires the user to successfully present at least pieces of evidence in the form of a certain possession, like a smartphone or USB key. It is secure, but the risk is that in customer environments, customers get annoyed by it and abandon usage. It also requires them to have those devices on hand, and not everyone uses the same technologies, so it is only a partial solution. According to Google, fewer than 10% of its users have signed up for two-factor authentication to protect their Google accounts.
This requires the user to successfully present at least pieces of evidence in the form of knowledge, like a security question. The challenge is that sometimes, users cannot recall their answers, which generates additional help desk inquiries.
When your user logs in, a proper credential screening tool compares their credentials (both user name and password) against a database containing billions of compromised credentials. This process works quietly in the background and takes place in milliseconds. If the user’s password and user name pair have been compromised, organizations can decide what to do next—for example: force a password reset, deploy step-up authentication, hide sensitive data on the account, etc.
“LastPass leverages Enzoic to screen billions of compromised credentials so that we can alert our users in the aftermath of a 3rd party data breach and put additional security measures in place. With this, we can help block account takeover attempts and other fraudulent activities.”
Sandor Palfy, CTO, LastPass by LogMeIn
These systems cross-reference IP address, geolocation, device reputation, and other behaviors to assign a risk score to an inbound login session and step-up authentication factors accordingly.
This is an interesting solution where the user’s fingerprint or face is used to authenticate. Users need to use a device that has biometric capabilities and many new devices include these biometrics features in the form of fingerprint readers or facial recognition.
Captchas are program or system intended to distinguish human from machine input, typically as a way of thwarting spam and automated extraction of data from websites. Simple checkboxes tend to be okay for end users but requiring too much work from the end-user can cause frustration and abandonment.
Overall, we found that captchas are often harder than they ought to be, with image captchas having an average solving time of 9.8 seconds… and audio captchas being much harder, with an average solving time of 28.4 seconds.
Stanford Captcha Study
There are also various technical ways to mitigate attacks like reviewing where your traffic is coming from, limiting traffic coming from Autonomous System Numbers (ASNs), blocking automated browsers that are frequently used by hackers, and tracking logins because if you have a lot of logins failures, that could be a sign of credential stuffing.