Hello and welcome to another
application of the modern attack
framework discussion today
we're going to be looking at our
case study on credential
access.
So this might be old
news, but it's still a relevant
discussion and something that I'm
sure you hear about in your
information security journey all the
time is
time to crack passwords.
Now, today, we're going to do a
quick comparison of a
the time it takes to create
passwords versus an attacker
with a match.
And so five characters point
three seconds. Seven is nine
minutes. Eight is two point six
days, nine characters, nine point
one years.
Strong, complex passwords,
seven point five million years.
Attacker who stole your password,
zero seconds.
So there's a stark difference here
between five characters
and the attacker that stole your
password in that it's
probably just as easy for
them to guess the password or five
character one or brute force it than
it is to steal it.
But in this case, the first two
categories, really, five characters,
seven characters and stealing
the credentials from another
source seem to be
of minimal effort.
Now, once we get to eight character,
nine character, 12, 12 character,
it starts to go up to days of time.
And depending on the threat actor
and what they're doing, that may not
be worth it.
So really,
this is just all to say that if you
reuse credentials,
it doesn't matter if you've got a 12
character password that can that can
be the end of you. So let's really
get to the point of the matter in
the discussion.
Do you change passwords often enough
to subvert a threat?
Actors attempts to log in with
stolen credentials because that's
really what we're looking at here.
Right. And the other side to that,
too, is, is that if your credentials
are stolen and it's not from your
system that you're
logging in to day in and day out,
did you use those credentials
elsewhere?
Right. So if you reuse credentials
and another site and that party is
compromised, does it
matter how secure the password is
that you login with?
If it's across multiple systems, you
increase risk of the password
being stolen and thereby being
used to get
into other systems.
Do you have password monitoring
measures in place to tell you when a
user might be reusing
their password?
Right. So some companies use
password vaults and things of that
nature that tells them when a
user is reusing credentials across
multiple systems, multiple
accounts, whatever the case may be.
So it's beneficial to ensure that
documentation and training is clear
on the dangers of password reuse
and what that can mean for the
security of an organization.
And then have you done a search
recently for passwords across your
file shares?
So if you're an administrator, I
challenge you this week to
get on your file share and just do a
quick search across the
drive and look for passwords
or password or pass, you
might be surprised how many Excel
spreadsheets, text documents and
little notes are floating around
on your domain that include all of
the user's credentials from multiple
accounts.
This is not secure.
If a threat actor gets on this
system and skims for the same
type of of nomenclature
password and they scrape all of
those documents out into a remote
share or something.
I mean, you've got more than just
one account to fix at that point.
So do a little digging.
And then if it's against company
policy, help users to find a way to
secure that information and
get it off those drops.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.