With over half of organizations being the victim of password-based attacks in the last year, new data sheds light on the risk of phishing attacks and the use of password-based credentials.
If you don’t think credentials are a key element in cyber attacks, I refer you back to an article of mine from the middle of last year where 15 billion (with a ‘b’) credentials are on sale on the dark web.
Fast forward nearly six months to December with cybersecurity vendor Axian’s 2023 State of Authentication Survey, to see if the world of cybersecurity has learned anything.
From what I can tell, everyone’s aware, but not everyone’s prepared.
According to the report:
- Phishing is the most feared cyber attack, according to 39% of organizations
- Phishing is also the attack method respondents believe is most likely to happen, according to 49% of organizations
- 89% of organizations believe their company is prepared to defend against the most-likely-to-happen cyber attack
- 88% believe their company is prepared to defend against a password-based attack
So, organizations definitely understand the risk found in phishing attacks , the value of a password to a cybercriminal, and believe they’re ready for it. But are they?
I’ve previously covered how credentials are one of the keys to successful cyber attacks, but it appears from the Axian data that organizations haven’t learned; according to Axian, 93% of organizations are still using passwords for authentication, making credentials the perfect target, and phishing attacks the perfect vehicle.
And only 22% of organizations are currently using some form of phishing-resistant multi-factor authentication (MFA). And by “phishing-resistant” one can only assume they are referring to something that addresses MFA prompt bombing, etc. Even worse, 52% admit their company has been the victim of a password-based attack in the last year.
I think at this point in our common experiences with cyberattacks and news about them, it’s obvious that credentials are a commonly utilized asset by cyber attackers. If you’re someone that agrees, then it’s equally obvious that something needs to change with regard to how credentials are protected – whether that be via multi-factor authentication, going completely passwordless, or protecting access to credentials of any kind by educating users via new-school security awareness training to never give them up in the first place.
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
