Brute force password cyber infiltrations have more than doubled in the last year as a share of overall attacks, security specialist Kaspersky said in a new incident analysis.
While a stringent password policy can lower the chances of being attacked by 60 percent and staying on top of patch management could drop the overall risk of cyber incidents by 30 percent, both protections remain stubbornly weak points in many organizations’ security profiles, Kaspersky said.
Two Stubborn Cybersecurity Issues
Despite most organizations knowing the importance of regular patching and password protections, in more than 60 percent of incidents investigated by Kaspsersky’s researchers, cyber attackers relied on brute force password assaults and exploited vulnerabilities as initial entry points to the network.
In the last year, the share of brute force password attacks as compared to other methods spiked to nearly 32 percent from 13 percent, most likely resulting from the seemingly immediate pivot to remote working. The second most commonly seen attack is vulnerability exploitation, also with a 32 percent share.
More than half of all attacks that started with malicious emails, brute force, and external application exploitation were detected in hours (18%) or days (55%). Still, some attacks lasted much longer, with an average duration of up to three months. Although brute force attack prevention and the control of timely updates do not seem to be problematic for a professional cybersecurity team, in practice, 100% elimination of these issues is virtually impossible,” Kaspersky said:
“Even if the IT security department does its best to ensure safety of the company’s infrastructure, factors such as legacy OS usage, low-end equipment, compatibility issues and human factors often result in security breaches that can jeopardize an organization’s security,” said Konstantin Sapronov, Kaspersky’s head of global emergency response team. “Protective measures alone can’t provide holistic cyber defense.”
Password Management and Vulnerability Management Tips
Kaspersky recommends organizations do this to minimize their threat risk:
- Implement a robust password policy, including multi-factor authentication and identity and access management tools.
- Ensure that patch management or compensation measures for public-facing applications have zero tolerance. Regular updates of vulnerability details from software vendors, scanning the network for vulnerabilities and patch installations are crucial for the security of a company’s infrastructure.
- Maintain a high level of security awareness among employees. Conducting comprehensive and effective third-party training programs for employees is a good way to save time of IT department and get good results.
- Implement an endpoint detection and response solution with a managed detection and response service, to detect and react to attacks promptly, among other measures. Advanced security services enable businesses to reduce the cost of attacks and prevent undesirable consequences.
