Learn what your business is doing wrong with passwords. 
By: George MateakiWith the recent release of PCI 3.2, one of the changes is the requirement that business must use multi-factor authentication within and out of the network. Multi-factor authentication includes at least two of the following:Something you know (password, code, etc.)Something you have (code sent to your phone)Something you are (fingerprint scan, etc.) Part of the authentication process includes passwords, but unfortunately passwords can bring their own set of problems.
The problem with passwordsThe biggest problem with passwords is they can be broken fairly easily through brute-force and dictionary attacks. Programs like John the Ripper and L0phtCrack are used to crack even complex passwords.Human nature also makes passwords insecure. Employees tend to choose passwords they can remember easily, often making it easy for a data thief to crack through social engineering. Many employees also tend to write down passwords or even share them with others for more convenience.Finally, there’s the matter of storage. Many applications transmit passwords in plaintext, making it easy for hackers to find and use.Unfortunately, many businesses don’t realize just how easily cyber thieves can crack a password, especially if it’s a common one. As a result, they have poor practices when it comes to password security.Here are some things businesses are doing wrong with passwords.
TweetDefault configuration: businesses will often keep the default passwords that were established when their routers/POS systems were set up. Most default passwords have been published on the internet, so that makes it fairly easy for hackers to break into your devices. Sharing credentials: sometimes employees will share accounts and credentials to save time. However, this makes it easy for social engineers to quickly gain access to sensitive data. Not updating passwords regularly: for many hackers, it’s only a matter of time before they crack a password, so businesses that have had the same passwords for their accounts since the day the company started are vulnerable. Choosing words like “password” or “admin”: these passwords are very common and are likely the first words hackers guess when trying to break into your remote access. SEE ALSO: Top Ten PCI Requirement Failures: Where is Your Business Struggling?Do we even need passwords anymore? It’s true that passwords alone will not secure your data very well, but it’s the baseline. The fact that many businesses aren’t even using basic password security shows how vulnerable their data may be.Eventually passwords may not be needed anymore as technology develops, but currently your devices and applications will still need unique, strong passwords.Password best practices So how do you make sure your passwords are secure? Here are some basic practices.Assign employees unique credentials/change default passwordsMake sure your employees aren’t using the same password or usernames. This will prevent social engineers from getting access to sensitive data simply by targeting one employee. Many companies will create a numeric user name that has absolutely no association with the actual name of the user. Changing the administrator account name to admin may meet the letter of the law but misses the intent. The administrator user name should be changed to something that does not indicate an administrator. This goes for any elevated access account used as the master/root access if the technology allows for this.You’ll also want to change all the default passwords on devices, otherwise you’re opening up your network to hackers. Follow for more data security articles like thisMake passwords long and complexThe longer your password, the better. Just like larger encryption keys are harder to break, longer passwords are more difficult to crack. The PCI DSS recommends businesses have passwords of at least eight characters, though I recommend at least 10-15 characters.You’ll also want to make them complex, using a mixture of numbers, symbols and letters. This seems like a no-brainer, but you’d be surprised how many people don’t follow this rule.Reset passwords oftenTrain your employees to reset passwords at regular intervals. For example, you could have them change passwords every 30, 60, or 90 days. Switching passwords often can help prevent the vulnerabilities of brute-force attacks. The less time hackers have on your password, the less likely they’ll crack it before you change it. The best approach is forcing users to change their passwords using technology per the current policy.Have limited login attempts:Set a number of times your employees can try to log into a system. After a number of unsuccessful logons, have the account lock out the one trying to get in. This will help prevent brute-force attacks and social engineers trying to guess passwords.SEE ALSO: 3 Data Security Best PracticesHow to create a strong password
Now days, using your favorite sport as a password doesn’t cut it anymore. Here’s a list of the top ten popular passwords for 2015:123456password12345678qwerty12345123456789football12341234567baseballSome additional passwords in the top 25 include, “dragon,” “welcome,” and “starwars.” None of these passwords are secure because they’re too easy to guess, being too common or relying on keyboard patterns. Hackers know these lists well and often use them as a first step to cracking your password. If any of your passwords are on this list, you’ll want to change them as soon as possible.Your best practice is to do a passphrase that’s unique to you. Take a phrase such as “I wear my sunglasses at night” and use the first letter of each word. Combine it with a number, such as a date, and you have a stronger password. Example: I wear my sunglasses at night= Iwmsg@n1980!You likely know these, but a few other basic guidelines for passwords include:Use a mixture of upper and lower-case lettersDon’t include name or other personal informationReplace some letters with numbersUse nonsense phrases, misspellings, or substitutionsDo not use repeating patterns between password changesDo not use the same passwords for work and personal accountsYou can’t really afford to have weak passwords. Ultimately a password isn’t going to completely secure your data. What you really need is to use a combination of multi-factor authentication, encryption, and other protocols to make sure your data is secure. But having a strong password is a good start.George Mateaki (CISSP, CISA, QSA, PA-QSA) is a Security Analyst at SecurityMetrics with an extensive background in Information Security and 20+ years in IT. 
Are The Shadow Brokers Like Snowden? Theory Suggests Insider Hack
By now, most of our readers have heard of the Shadow Brokers, the hacker group who obtained a large trove of data from the National Security Agency (NSA) and leaked information about the NSA’s cyber tools. The cyber tools were apparently stolen from the Equation Group, a cyber attack operation who experts believe are part of the NSA.
(Watch a quick overview about the NSA hack – “NSA Reportedly Hacked By Group Called The Shadow Brokers”):
Initially, evidence suggested that the Shadow Brokers were Russian, but a new theory is emerging that whoever is leaking this data might be “a second Edward Snowden… albeit one with different motives” (Fortune). James Bamfield, a journalist who is well known for his publications about United States intelligence agencies, believes that Russia would not want to publish these hacks if they obtained them, because companies would quickly patch their vulnerabilities and the information would soon be worthless to anyone trying to sell the data. He also brings up that the bad English used by the hackers seems to be phony. Furthermore, he suggests that the hacker(s) could be linked to the NSA’s Tailored Access Operations (TAO) which is a unit of the surveillance agency that gathers intelligence related to cyber-warfare. He states:
“Rather than the NSA hacking tools being snatched as a result of a sophisticated cyber operation by Russia or some other nation, it seems more likely that an employee stole them. Experts who have analyzed the files suspect that they date to October 2013, five months after Edward Snowden left his contractor position with the NSA and fled to Hong Kong carrying flash drives containing hundreds of thousands of pages of NSA documents.
So, if Snowden could not have stolen the hacking tools, there are indications that after he departed in May 2013, someone else did, possibly someone assigned to the agency’s highly sensitive Tailored Access Operations” (Reuters).
As of now, the “second Snowden” theory is just that – a theory. Most experts still say Russia is behind the hacks. Nevertheless, as Bamford puts it in his commentary – the “NSA may prove to be one of Washington’s greatest liabilities rather than assets.”
The post Are The Shadow Brokers Like Snowden? Theory Suggests Insider Hack appeared first on Social Hax.
Reciprocal altruism: Helping and forming bonds with nonrelatives
It was the birthday of a co-worker of Monica’s. It had been four years now them working together. Previously, they just used to greet each other on their respective birthdays. But this year Monica’s friend gave her a gift on her birthday. Monica felt compelled to the same for her friend, even though she’d never done it before.When someone does a favor for us, why do we feel tempted to return it?Why are we likely to help those who’ve helped us before?Why do we tend to buy gifts for those who do the same for us?Reciprocal altruismOne should expect altruistic acts from one’s immediate family- one’s closest genetic relatives. This is because by helping each other survive and reproduce, a family is essentially helping its shared genes to successfully pass on to the next generation.But what explains altruism outside of the family?Why do people form close bonds with those who’re not related to them?It’s all due to a psychological phenomenon known as reciprocal altruism. In simple words, reciprocal altruism is nothing but mutual benefit. We form bonds with people and help them so that we may get helped in return. Friendships simply can’t exist without the prospect of mutual benefit.
Origins of reciprocal altruismDuring most of our evolutionary history, hunting was the main activity for procuring food. But success from hunting was unpredictable and erratic. One week a hunter would obtain more meat than required and another week he’d acquire nothing at all. Add to this the fact that meat can’t be stored for long and is easily spoiled. Our hunter ancestors therefore could only survive if they somehow ensured a continual supply of food. This generated selection pressure for reciprocal altruism, meaning that those who had mutual altruistic tendencies were more likely to survive and out-reproduce those who did not have such tendencies. Those who were helped, helped others in the future. Therefore, altruistic tendencies are widespread amongst today’s humans.Reciprocal altruism is found in the animal kingdom too. Chimpanzees, our closest cousins, form alliances to boost their chances of survival and reproduction. A dominant male-male alliance in chimps is likely to out-reproduce other males.Vampire bats that suck cattle blood at night don’t always succeed. It has been observed that these bats provide regurgitated blood to their ‘friends’ when they’re in dire need. These ‘friends’ are bats who had provided them with blood in the past! They form close associations with each other even though they’re unrelated.Shadow of the futureReciprocal altruism is likely to occur when there’s a large shadow of the future. If the other person thinks that they’ll be interacting with you frequently in the extended future, then they have a strong incentive to be altruistic towards you. They expect you’ll be altruistic towards them in the future too.On the other hand, if the other person thinks that they won’t be interacting with you for long (i.e. a small shadow of the future), then there seems to be no point in being altruistic. This is one reason why most friendships in schools and colleges happen at the beginning of the academic year and not when the course is nearing its end.At the beginning, students seek other students who might benefit them during the course. There’s simply no point in making friends when you’re hardly going to interact in the future. If it looks like a friend is going to be altruistic towards you beyond college, then you’re likely to form a lifelong bond with that friend. If a friend has helped you a lot in the past and so have you, then you’re likely to form a lifelong friendship with them because you’ve both already demonstrated your respective commitment to reciprocal altruism.When there’s no future to look forward to, chances of reciprocal altruism are less. It’s all about mutual benefit.
- « Previous Page
- 1
- …
- 125
- 126
- 127
- 128
- 129
- …
- 561
- Next Page »