Credential Vulnerabilities Most Likely Breach Culprit: Verizon DBIR

According to Verizon’s recently released 2020 Data Breach Investigations Report (DBIR), over 80% of hacking-related breaches involved the use of lost or stolen credentials. We analyzed the findings and uncovered some additional data points that underscore how pervasive and detrimental poor password practices are to businesses today. Looking at the DBIR data in detail, approximately 35% of all breaches were initiated due to weak or compromised credentials.

To put it another way, your company is more likely to have a breach as a result of stolen or weak credentials than any other single reason. So, why do companies continue to struggle with password security when it’s clearly such a business-critical issue?

There are a variety of factors, among them:

• Password Reuse. We’ve written about this multiple times before on this blog but it bears repeating: the majority of people reuse passwords and share them across both personal and work accounts even though they recognize the inherent security vulnerabilities. This pervasive bad habit has been around for years, and it shows no signs of abating as the world grows increasingly digital and reliant on more online accounts and services.
  
  
• The Friction Factor. Employees typically demand efficiency and convenience from their enterprise systems and applications, and can balk when too much friction is introduced into the process. If authentication mechanisms are overly burdensome, many will default to poor password practices or risky behavior like sharing credentials with colleagues.
  
  
• The Long-Tail Effect. When hackers obtain stolen credentials from the Dark Web, they don’t often act on this information right away. For example, as we noted in a previous post, the exposure of credentials from the NIH, WHO and others engaged in the fight against COVID-19 was due to prior breaches with the 2016 LinkedIn attack being the primary source. Underscoring this issue, research from Virginia Tech University found that over 70% of users employed a compromised password for other accounts up to a year after it was initially leaked, with 40% reusing passwords which were leaked over three years ago.

As the DBIR put it, “Criminals are clearly in love with credentials, and why not since they make their jobs much easier?” In this environment, the only way companies can fight back is by employing a solution that continually screens for compromised credentials and introduces friction only when the situation warrants it. With breaches happening on a near real-time basis, it’s not enough to check password security only at its creation. Organizations need an ongoing way to ensure that credentials that were once secure have not become compromised, and that’s where Enzoic comes in.

There’s plenty to worry about in the modern threat landscape but compromised credentials should not be one of them. Learn more about our approach, and how we can help you eradicate the credential vulnerability for good.