Weaknesses In Pasword Security

Answer 1

Enterprise paswords are typically compromised due to

Use of Default Paswords – Many IT assets, especially devices, have a default pasword applied out of the box. End users are also often granted initial access to corporate systems through a pasword created by the IT team. Using these default credentials makes pasword compromise easy for cyberattackers Creation of Weak Paswords – Paswords that are short and have limited character variety or are linked to the identity of the user (e.g., birthday combined with name of spouse) are easy to guess and therefore easy to compromise Pasword Reuse – End users may create one pasword that is used across multiple services. Threat actors that obtain the pasword by compromising one service can now use the pasword to gain access to other services. The Colonial Pipeline attack in the USA, which resulted in fuel shortages, was made possible by pasword reuse Pasword Recycling – End users may use older paswords again after an interval of time, allowing threat actors to enter the organisation through paswords that have been previously compromised Pasword Sharing – Employees who are in the habit of sharing paswords amongst themselves increase the probability of an internal threat actor misusing the shared paswords, or selling the paswords to an external threat actor Poor Pasword Storage – End users may store paswords in plain text files which may be exfiltrated by cyberattackers, or leave them written on their desks where they may be stolen by anyone with physical access to the desk This may be considered a list of worst practices in the context of pasword security. Let us now understand how threat actors may obtain these paswords.