{"id":4232,"date":"2019-01-31T16:01:54","date_gmt":"2019-01-31T20:01:54","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=4232"},"modified":"2019-01-31T16:03:19","modified_gmt":"2019-01-31T20:03:19","slug":"cybersecurity-experts-what-you-need-to-know-about-collections-2-5","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/","title":{"rendered":"Cybersecurity Experts: What You Need to Know about Collections #2-5"},"content":{"rendered":"

\"Cybersecurity<\/p>\n

Just a few weeks ago, Troy Hunter shared his discovery of Collection #1<\/a> with the world. Collection #1<\/a>, a folder containing 773 million leaked emails and 21 million leaked passwords, floated about the Dark Web and hacker forums for an unknown amount of time before its discovery; cybersecurity experts called it the largest dump of stolen accounts in history. <\/span><\/p>\n

Unfortunately, we should have known it could get worse. Collection #1 pales in comparison to what <\/span>Wired<\/span><\/i><\/a> just discovered: Collections #2-5. <\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

Collections #2-5, much like #Collection 1, contain stolen records. Specifically, Collections #2-5 contain 25 billion stolen records; after removing duplicates, the folders still hold 2.2 billion usernames and passwords. The sheer scale of this data breach alone sends shudders in the hearts of cybersecurity observers everywhere. <\/span><\/p>\n

Moreover, Collections #2-5 floated the Dark Web for some time before discovery. In the Wired article, Chris Rouland of Phosphorus.io notes over 1,000 downloads of the collections on torrent sites. <\/span><\/p>\n

What can you do about Collections #2-5? How can your enterprise defend itself against such a monumental blow to users\u2019 data? We spoke with identity management experts to find out: <\/span><\/p>\n

Tom Garrubba, Sr. Director, <\/b>Shared Assessments<\/b><\/a>: <\/b><\/span><\/h3>\n

\u201cThis is indeed a massive amount of records, and we don’t know all of the sources of these breached records. The importance of a healthy third-party risk management program that includes continuous monitoring and effective threat management over your organization’s data becomes even more crucial than ever.\u201d <\/span><\/p>\n

\u201cAll data connection points need to be understood, reviewed, assessed, and continuously monitored in alignment with the outsourcing organization\u2019s risk posture to ensure that both they as the outsourcer, their full network of service providers, and other third parties with whom they share data are all fulfilling their security and privacy expectations laid out in their contracts.\u201d \u00a0<\/span><\/p>\n

\u201cFor those individuals who have not yet locked down there credit history and files, it’s worth considering. \u00a0Basic steps to do this are at: <\/span>https:\/\/www.consumer.ftc.gov\/articles\/0497-credit-freeze-faqs#place<\/span><\/a>\u201d<\/span><\/p>\n

Frederik Mennes, Senior Manager Market & Security Strategy, Security Competence Center,<\/b> OneSpan<\/b><\/a>:<\/b><\/span><\/h3>\n

\u201c2.2 billion records is a staggering number. We are becoming accustomed to breach notification news, but sad to say, the use of multi-factor authentication is still not utilized whenever and wherever possible.\u201d<\/span><\/p>\n

\u201cMFA combines at least two out of three of the following technologies: something you know (such as a PIN), something you have (such as an authentication app on the smartphone) or something you are (such as a fingerprint or facial recognition). The passwords that are generated only last for a limited period of time, which makes it useless for hackers to intercept and reuse them.\u201d<\/span><\/p>\n

\u201cTechnology is evolving. Next-generation authentication, intelligent adaptive authentication, is gaining momentum. This technology ensures the precise level of security for each level of interaction with the best possible experience for the user. Adaptive authentication utilizes AI and machine learning to score vast amounts of data. Based on patterns, it analyses the risk of a situation and adapts the security and required authentication accordingly.\u201d<\/span><\/p>\n

\u201cCompanies should remember that easy targets will continue to be exploited first, because cybercrime follows the path of least resistance. Applying multi-factor authentication may stop an attacker as the attacker might go after only users that have not enabled stronger authentication.\u201d<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

Terry Ray, Senior Vice President and <\/b>Imperva<\/b><\/a><\/span> Fellow:<\/b><\/h3>\n

\u201cThe emails and associated passwords were, unfortunately, made readily available to cybercriminals, who can now wreak havoc on the daily lives of the victims. This collection of credentials gives cybercriminals the ammo needed to attempt credential stuffing, password guessing and other iterative processes at account takeover, which is essentially giving cyber attackers a key to your front door.\u201d <\/span><\/p>\n

\u201cArmed with the recent and past credentials, hackers could access consumers data, troll social media platforms to spread propaganda, cash in on hard-earned airline miles, sell contact data for spammers and even access bank accounts. To make matters worse, if consumers reused passwords at work, hackers would breaking into enterprise infrastructures to steal corporate data costing businesses millions in damages if that data were to get into the wrong hands.\u201d<\/span><\/p>\n

\u201cThis is why it is critical that consumers never reuse passwords across different accounts they hold, but also change these passwords consistently and set up dual-factor authentication to better protect themselves. If you have taken these precautionary steps, it is unlikely that cybercriminals will successfully break into your accounts.”<\/span><\/p>\n

“They might temporarily lock you out as a result of attempting to brute force themselves into accounts. If your online services offer account change notifications and two-factor authentication I suggest you use these to further inform you of unusual account activity and make taking over your account more difficult.\u201d<\/span><\/p>\n

\u201cBusinesses should be extra vigilant over the next few weeks as these credentials make their rounds through the dark channels. Post credential leak account takeover attempts have historically spiked immediately following incidents like this. Successful logins using these credentials are difficult to identify, though technology does exist to assist IT Security teams.\u201d<\/span><\/p>\n

Sarah Whipp, CMO and Head of Go to Market Strategy,<\/b> Callsign<\/b><\/a>: <\/span><\/span><\/h3>\n

\u201c<\/b>The huge bounty should serve as the final nail in the coffin for the traditional password, but the truth is, it probably won\u2019t. With over 2.2 billion unique username and password combinations, even if 1% of these records are utilized to compromise accounts, that is still nearly 25 million accounts in jeopardy. That is beyond alarming. Since humans are creatures of habit, we can expect many of the same combinations are reused across multiple accounts, adding even more insult to injury.\u201d<\/span><\/p>\n

\u201cThis is moving beyond a technological or cybersecurity argument. The breadth and depth of breaches are making this a humanitarian issue and we need to completely rethink our approach to digital identity and security. We may never be able to move completely away from the username and password, but we can take intermediary steps to make securing digital identity more of a global priority. This starts with encouraging further adoption of two-factor (2FA) and multi-factor authentication (MFA<\/a>) that incorporates biometrics to help us take back control and protect our identities.\u201d<\/span><\/p>\n

\u201cWhile we have come leaps and bounds in terms of biometric authentication technology, improving the protection of our identities online, the ability to collect sufficient biometric data tends to be quite difficult and consequently not 100% secure. By incorporating both hard biometric characteristics like facial recognition, fingerprints and iris scanning; along with soft characteristics like how people type, move their mouse or hold their phone, we can start to create security protections both personal and unique to each individual.”<\/span><\/p>\n

“Coupled with advanced machine learning and artificial intelligence, we can develop security profiles that will work with everything from simple feature phones all the way to cutting edge flagship devices. This way, we can begin to help guarantee the security of all customers, even when personal credentials are stored in plain text on the dark web.\u201d<\/span><\/p>\n

Thank you to these experts for their comments on Collections #2-5, their time, and their expertise!<\/strong><\/h4>\n


Widget not in any sidebars
<\/p>\n","protected":false},"excerpt":{"rendered":"

Just a few weeks ago, Troy Hunter shared his discovery of Collection #1 with the world. Collection #1, a folder containing 773 million leaked emails and 21 million leaked passwords, floated about the Dark Web and hacker forums for an unknown amount of time before its discovery; cybersecurity experts called it the largest dump of […]<\/p>\n","protected":false},"author":41,"featured_media":2485,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[142,125,836,988,1025,16,112,76,188,1023,70,145,30,908,91,1024],"acf":[],"yoast_head":"\nCybersecurity Experts: What You Need to Know about Collections #2-5<\/title>\n<meta name=\"description\" content=\"We should have known it could get worse. Collection #1 pales in comparison to what Wired just discovered: Collections #2-5.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/\",\"name\":\"Cybersecurity Experts: What You Need to Know about Collections #2-5\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/03\/hacker-insider-threats-mod.jpg\",\"datePublished\":\"2019-01-31T20:01:54+00:00\",\"dateModified\":\"2019-01-31T20:03:19+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"We should have known it could get worse. Collection #1 pales in comparison to what Wired just discovered: Collections #2-5.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/03\/hacker-insider-threats-mod.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/03\/hacker-insider-threats-mod.jpg\",\"width\":800,\"height\":400,\"caption\":\"Think Your SMB Is Safe From Cyber Threats? You're Wrong\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Experts: What You Need to Know about Collections #2-5\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services\",\"description\":\"Identity Access Management (IAM) News, Best Practices and Buyer's Guide\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cybersecurity Experts: What You Need to Know about Collections #2-5","description":"We should have known it could get worse. Collection #1 pales in comparison to what Wired just discovered: Collections #2-5.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/","url":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/","name":"Cybersecurity Experts: What You Need to Know about Collections #2-5","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/03\/hacker-insider-threats-mod.jpg","datePublished":"2019-01-31T20:01:54+00:00","dateModified":"2019-01-31T20:03:19+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"We should have known it could get worse. Collection #1 pales in comparison to what Wired just discovered: Collections #2-5.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/03\/hacker-insider-threats-mod.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/03\/hacker-insider-threats-mod.jpg","width":800,"height":400,"caption":"Think Your SMB Is Safe From Cyber Threats? You're Wrong"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/cybersecurity-experts-what-you-need-to-know-about-collections-2-5\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Experts: What You Need to Know about Collections #2-5"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Best Identity Access Management (IAM) Software, Tools, Vendors, Solutions, & Services","description":"Identity Access Management (IAM) News, Best Practices and Buyer's Guide","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/4232"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=4232"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/4232\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/2485"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=4232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=4232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=4232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}