The key to our engagements often and unfortunately involve the discovery of credentials on internal network file shares. We’re going to show you how we find cleartext password storage problems and how to address them.
Password. Password123. Yea, you’ve seen them all when it comes to bad passwords. It comes standard when managing IT security.
But while your organization likely requires special characters, uppercase letters and even a number or two, if you don’t require longer passwords you’re not taking one of the most important steps to protect your network.
We’ve laid out 14 credible reasons to require everyone in your organization to use 14-character passwords. We’re pretty sure you’ll be convinced. If not, long live Password123.
Given how often we see this tactic used, we’re going to break down the basics. We want to help you understand how password spraying works, along with some effective steps you can take to prevent it from being used against your organization.
What is password spraying?
Over the past years, we’ve urged companies to start using Multi-factor authentication (MFA) – and many have followed through. Unfortunately, we have a long way to go.
First, the good news. MFA protects by adding a layer of security using an out-of-band authentication step, making it harder for attackers to gain access to an organization. Not to mention, it keeps security top-of-mind for users, since they’re notified during each authentication.
- Password spraying and MFA bypasses in the modern security landscape
- Crossing the Log4j Horizon - A Vulnerability With No Return
- Another Log4j on the fire: Unifi
- How to exploit Log4j vulnerabilities in VMWare vCenter
- Leading and Empowering Your Team During Log4j