So, Your MFA is Phishable, What To Do Next

Aug 31, 2022 9:54:49 AM By Roger Grimes

We’ve written a lot about multi-factor authentication (MFA) not being the Holy Grail to prevent phishing attacks, including here:

[KREBS ON SECURITY] How 1-Time Passcodes Became a Corporate Liability

Aug 30, 2022 11:45:43 AM By Stu Sjouwerman

[The following article is at it appears at Krebs on Security here.] Phishers are enjoying remarkable success using text messages to steal remote access credentials and one-time passcodes ...

What About Password Manager Risks?

Jun 9, 2022 10:13:18 AM By Roger Grimes

In KnowBe4’s new Password Policy ebook, What Your Password Policy Should Be, we recommend that all users use a password manager to create and use perfectly random passwords. A perfectly ...

Why We Recommend Your Passwords Be Over 20-Characters Long

Jun 3, 2022 8:13:08 AM By Roger Grimes

KnowBe4 just released its official guidance and recommendations regarding password policy. It has been a project in the works for many months now, but we wanted to make sure we got it ...

Introducing KnowBe4’s Password Policy E-Book

Jun 3, 2022 8:11:54 AM By Roger Grimes

KnowBe4 just released its first e-book covering password attacks, defenses and what your password policy should be. Here is a summary of its recommendations:

Microsoft is Leading the Way to a Password-Less Future

May 5, 2022 9:08:33 AM By Stu Sjouwerman

As we observe World Password Day to create awareness around the need for password security, Microsoft is looking for frictionless ways to eliminate passwords entirely.

How Hackers Steal Passwords & Protection Tips

Apr 26, 2022 9:54:16 AM By Roger Grimes

Despite the world’s best efforts to get everyone off passwords and onto something else (e.g., MFA, passwordless authentication, biometrics, zero trust, etc.) for decades, passwords have ...

Passwords are Reused 64% of the Time as the Number of Passwords to Remember Reaches Over 100

Mar 10, 2022 9:30:39 AM By Stu Sjouwerman

New data focusing on user cyber hygiene around password use shows users are repeatedly reusing passwords across multiple applications and environments, despite the rise in breaches.

Over 1200 Man-in-the-Middle Phishing Toolkits Designed to Intercept 2FA Found in the Wild

Jan 6, 2022 2:19:54 PM By Stu Sjouwerman

An academic partnership between Stony Brook University and Palo Alto Networks uncovered a massive use of tools that will steal authentication cookies mid-stream instead of credentials.

New York State Warns of Credential Stuffing

Jan 6, 2022 1:17:59 PM By Stu Sjouwerman

New York Attorney General Letitia James has released a guide to help businesses defend themselves against credential stuffing attacks. Credential stuffing is a type of brute-force attack ...

Victims: After a Data Breach, Changing Passwords and Good Password Hygiene Remain Unimportant

Dec 7, 2021 10:53:12 AM By Stu Sjouwerman

New shocking data shows how unconcerned victim users are after being notified of a data breach involving their credentials, personal information, and even social media accounts.

Russian SolarWinds Hackers Newly Attack Supply Chain With Password-Spraying and Phishing

Oct 26, 2021 9:38:10 AM By Stu Sjouwerman

Researchers at Microsoft have observed an attack phishing campaign by Russia’s SVR that’s targeting resellers and managed service providers. Microsoft tracks this threat actor as ...

When It Comes to Password Hygiene, Users Say One Thing, But Do Another

Oct 8, 2021 9:09:51 AM By Stu Sjouwerman

With credentials being at the forefront of most cyberattacks, the need for strong, unique passwords is at an all-time high. But new data shows users know what to do, but don’t do it.

Social Media Quizzes May Be Data Scrapers Building Victim Profiles

Sep 21, 2021 3:58:01 PM By Stu Sjouwerman

The seemingly benign quizzes asking personal details take advantage of individuals’ willingness to share and could be used to establish passwords, password hints, and more.

Brute Force Attacks are on the Rise as June sees a 671% increase

Sep 16, 2021 8:55:00 AM By Stu Sjouwerman

With nearly one-third of all organizations targeted in a single week and just above one-quarter on the average, attempts to access externally facing resources is growing in popularity and ...

3 Ways To Protect Your Identity Online

Apr 13, 2021 8:00:00 AM By James McQuiggan

Within security awareness training programs, cybersecurity experts promote various tactics and best practices to implement within personal and work environments to protect your identities ...

The Three Best Things You Can Do To Improve Your Computer Security

Feb 9, 2021 7:48:35 AM By Roger Grimes

The three best things you can do to improve your computer security, bar anything, have been the same three things you should have already been doing for the entirety of computers. The top ...

Thousands of Stolen Credentials Accessible via Google Search as Cybercriminals Accidentally Make Them Public

Jan 22, 2021 11:39:25 AM By Stu Sjouwerman

A publishing goof by cybercriminals on a WordPress site made files containing stolen passwords indexable by Google and were subsequently publicly available via search.

Eye-Opening Password Predictions: Remote Work Will Increase Risk for Data Breaches

Dec 21, 2020 2:12:55 PM By Stu Sjouwerman

Ponemon's State of Password and Authentication Security Behaviors Report analyzes password and security behaviors over time with similar trends. We wanted to deep dive into the reports of ...

Over Half of Users Admit to Reusing the Same Password on Multiple Accounts

Dec 17, 2020 3:50:39 PM By Stu Sjouwerman

New data reported earlier this year by Security Magazine shared a report from Secure OAuth that 53% of users reuse the same passwords on multiple accounts. Among those 44% admit to using ...