Passwords serve as the foundation for most security today. But security vendor SpyCloud have recovered over 3.5 billion credentials, demonstrating just how insecure they really are.
We’d like to think that in this day and age, users are aware that they need to use secure passwords. Putting aside cyberattacks focused on tricking users into providing credentials, the passwords themselves should be complex enough that they’re not easy to break.
But, according to SpyCloud’s Annual Credential Exposure Report, released last month, passwords (and their encryption) are anything but secure.
SpyCloud was able to recover over 3.5 billion credentials from over 2800 breached sources. They decrypted nearly 90% of all the passwords collected, yielding 2.3 billion plaintext passwords. According to the report, the cracking of the passwords was easy. The encryption methods used aren’t a challenge for the sophisticated software used by cybercriminals.
And to boot, the passwords themselves weren’t very secure – adding to the ease of decryption. Passwords like “12345”, “password”, “iloveyou”, and “qwerty” continue to top the list of the most commonly used.
So, what’s to blame when it comes to exposed credentials?
There are a few factors:
Employees are the weakest link in network security, using weak passwords and falling for phishing and social engineering attacks. KnowBe4’s complimentary Weak Password Test (WPT) checks your Active Directory for several different types of weak password related threats. Here's how it works:
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser: