New PCI Password Requirements Could Be the Impetus for Credential Harvesting Scams

password-hacksAs the retirement countdown for the current version of PCI is now less than six months, a new standard for password length, complexity, and change frequency may create some risk.

Valid credentials have become a very hot item, as threat actors realize the low risk and high value of simply becoming an Initial Access Broker (rather than performing an entire cyber attack themselves). We’ve seen countless attacks where the focus was to simply gather a user’s credential to either an online platform or their on-premises network.

The newest version of the Payment Card Industry’s Data Security Standard (better known as PCI DSS) – version 4.0 – is set to become the standard next April, according to a PCI press release. While many of the new standards will be considered “best practices” for a time, some standards are all too familiar to cybersecurity professionals – which includes some new standards on protecting passwords. In Procedure 8.6.3, there are a few specific requirements around passwords:

  • Passwords must be changed periodically (with the frequency based on an organization’s own risk analysis)
  • Passwords must be sufficiently complex (taking into consideration the password change frequency as well)

While these requirements are important, they also provide cybercriminals with a new opportunity to send out fake “password reset” requests to any kind of important system, citing the PCI standard to add credibility to the scam. In the end, with a little social engineering and some believable brand impersonation of the soon-to-be-compromised platform, it’s likely users will fall for such a campaign.

So, it becomes important to educate users how to spot fake password reset requests – whether related to PCI v4.0 or not – through continual security awareness training. There are always telltale signs – sender email addresses, poor user experience, improper URLs, etc. – so by training users about these kinds of scams and other cyber attack tactics, you can reduce the risk of successful compromise of your most precious asset – your organization’s credentials.

Are your user’s passwords…P@ssw0rd?

Employees are the weakest link in network security, using weak passwords and falling for phishing and social engineering attacks. KnowBe4’s complimentary Weak Password Test (WPT) checks your Active Directory for several different types of weak password related threats.

wpt02Here's how it works:

  • Reports on the accounts that are affected
  • Tests against 10 types of weak password related threats
  • Does not show/report on the actual passwords of accounts
  • Just download the install and run it
  • Results in a few minutes!

Check Your Passwords

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews