Password spraying and MFA bypasses in the modern security landscape

Any offensive security operator will tell you that guessing employee credentials is key to compromising your customer’s network – and therefore highlighting vulnerabilities – during a cyber-security engagement. The thing is, it’s easier said than done as companies increasingly continue to transition to cloud services such as Microsoft Office 365 (O365) – all of which provide multi-factor authentication (MFA)

Read More...

How to limit cleartext password storage and fix the issue in your organization

The key to our engagements often and unfortunately involve the discovery of credentials on internal network file shares. We’re going to show you how we find cleartext password storage problems and how to address them.

Read More...

Fourteen good reasons to require 14-character passwords

Password. Password123. Yea, you’ve seen them all when it comes to bad passwords. It comes standard when managing IT security.

But while your organization likely requires special characters, uppercase letters and even a number or two, if you don’t require longer passwords you’re not taking one of the most important steps to protect your network.

We’ve laid out 14 credible reasons to require everyone in your organization to use 14-character passwords. We’re pretty sure you’ll be convinced. If not, long live Password123.

Read More...

Credential Stuffing: 5 basics you need to understand

It’s tempting to re-use the same password for multiple online accounts. Many of us have done it (it’s OK; this is a safe space). Convenient as it seems, this action puts you at high risk to get hacked via credential stuffing.

Read More...

Multi-Factor Authentication: How attackers still abuse these (often forgotten about) logins

Over the past years, we’ve urged companies to start using Multi-factor authentication (MFA) – and many have followed through. Unfortunately, we have a long way to go.

First, the good news. MFA protects by adding a layer of security using an out-of-band authentication step, making it harder for attackers to gain access to an organization. Not to mention, it keeps security top-of-mind for users, since they’re notified during each authentication.

Read More...