![\"The](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/08\/2019-SIEM-CEO-MAIN-MOD.jpg\")
<\/p>\n<\/p>\n
Throughout 2019, we suffered from breaches. A lot of breaches. Too many breaches. As a result, we spoke to authentication experts. Thus we gleaned expert authentication lessons from numerous sources throughout the year.\u00a0<\/span><\/p>\n Of course, the data breaches continue to proliferate because enterprises persist in the belief that they are immune to hacks and attacks. Nothing could be further from the truth. In fact, without an identity management solution to serve as perimeter and principle defense, your enterprise could end up as a headline. Actually, hackers prefer to target enterprises with legacy identity security as easy targets.\u00a0<\/span><\/p>\n Please use the example of past breaches as a model of what not to do. Recent studies indicate customers tend to abandon enterprises after they suffer a data breach. Additionally, 60 percent of small businesses<\/a> go out of business after a data breach according to Switchfast Technologies.<\/p>\n We reported on the <\/span><\/i>State Farm Credential Stuffing Attack<\/span><\/i><\/a> on September 6, 2019. These expert authentication lessons come from Anurag Kahol, CTO of <\/span><\/i>Bitglass<\/span><\/i><\/a>.\u00a0\u00a0\u00a0<\/span><\/i><\/p>\n \u201cThis hack could have been prevented if the company used dynamic identity and access management solutions that can detect potential intrusions. Organizations should authenticate their users in order to ensure that they are who they say they are before granting them access. Fortunately, multifactor authentication (MFA) and user and entity behavior analytics (UEBA) are two tools that can help companies to defend customer information as well as the rest of their corporate data.<\/span><\/p>\n Additionally, people commonly reuse passwords across multiple accounts, which means if a cybercriminal gains access to login information for one account, they can potentially gain access to various accounts for that individual across multiple services. Although State Farm has reset account passwords after hackers gained access to its systems, other accounts for those users could still be in jeopardy. Customers should change their passwords not only for State Farm but across all accounts where that same password may be used. Better yet, they should stop using the same passwords across multiple accounts altogether.\u201d\u00a0<\/span><\/p>\n We reported on the <\/span><\/i>Verification.io Database Leak<\/span><\/i><\/a> on March 29, 2019. These expert authentication lessons come from Byron Rashed, VP of Marketing of <\/span><\/i>Centripetal Networks<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n \u201cBusinesses and consumers should always verify and deal with trusted businesses. In today\u2019s digital environment, giving electronic information out about one\u2019s self is exposing the individual to a variety of cyber crimes. Credentials can be leveraged by a threat actor for identity theft on a personal level and corporate network infiltration and data exfiltration for businesses.<\/span><\/p>\n Enterprises should enable blocking of such malicious sources, which is key to preventing network infiltration and reducing and mitigating the risk of data exfiltration. Corporate policy should govern and prevent the use of their corporate credentials on non-work related sites as well. Education of employees is always the best first line of defense since most breaches are caused by human error.\u201d<\/span><\/p>\n We reported on the <\/span><\/i>Sprint Breach<\/span><\/i><\/a> on July 17, 2019. These expert authentication lessons come from Robert Prigge, President of <\/span><\/i>Jumio<\/span><\/i><\/a>.\u00a0\u00a0<\/span><\/i><\/p>\n \u201c[The Sprint breach] provides yet another wake-up call for any company that still protects their users\u2019 online accounts with a simple username and password. We now live in zero-trust world thanks to the dark web and near-daily data breaches. Any cybercriminal with limited skills can perpetrate account takeover fraud with ease. Online accounts need to be protected with much stronger forms of biometric-based authentication. This is no longer a nice-to-have feature \u2014 it\u2019s a must-have. The good news is that users are now ready for simple face-based biometrics (thanks to Apple\u2019s Face ID). It\u2019s even easier, faster and way more secure than legacy methods of authentication.\u201d\u00a0<\/span><\/p>\n We reported on the <\/span><\/i>Chipotle Credential Stuffing Attack<\/span><\/i><\/a> on April 18, 2019. These expert authentication lessons come from Stephen Cox, Chief Security Architect of <\/span><\/i>SecureAuth<\/span><\/i><\/a>.\u00a0\u00a0<\/span><\/i><\/p>\n \u201cCredential stuffing [constitutes] the process of acquiring a cache of previously stolen credentials and using them, often in an automated fashion, to gain unauthorized access to a resource. It is a popular technique for attackers looking to break into both consumer and enterprise accounts because people often reuse passwords across multiple accounts.<\/span><\/p>\n \u201cThis swell of consumer account breaches is unfortunately common today and is evidence that our continued reliance on passwords is not sustainable and ultimately fails users. Decades of experience shows us that the password is an archaic method of authentication, often not under the control of the user, and simply isn\u2019t enough to satisfy today\u2019s threat landscape. The reality is that people will continue to reuse passwords across multiple resources, allowing stolen credentials to have far-reaching consequences like Chipotle customers are experiencing.\u201d<\/span><\/p>\n We reported on the <\/span><\/i>VFEmail Incident<\/span><\/i><\/a> on February 12, 2019. These expert authentication lessons come from Terence Jackson, Chief Information Security Officer of <\/span><\/i>Thycotic<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n \u201cThis type of attack highlights the significance of having, updating and testing your disaster recovery\/business continuity plans frequently and using an established Privileged Access Management solution.<\/span><\/p>\n The about page on the website shows a network diagram that includes an offsite backup server attached to the public internet. At this point, I believe we still have more questions than answers.<\/span><\/p>\n However, I do believe that the owner gave us a nugget as to how the compromise occurred. Rick Romero stated \u2018This was more than a multi-password via ssh exploit.\u2019 So, was this simply a Brute Force attack? Credential Stuffing?\u00a0 Based on his statement, perhaps. Nevertheless, there are some good best practice takeaways from this incident:<\/span><\/p>\n We reported on the Leak of Collections #2-5<\/a> on January 31, 2019. These authentication lessons come from Sarah Whipp, CMO and Head of Go-To-Market Strategy at <\/span><\/i>Callsign<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/01\/PAM_BG_SB_800.gif\" "\\"\\"")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\nIdentity Expert Authentication Lessons From 2019<\/b><\/h2>\n
State Farm Credential Stuffing Attack<\/b><\/h3>\n
Verifications.io Database Leak<\/b><\/h3>\n
The Sprint Breach\u00a0<\/b><\/h3>\n
The Chipotle Credential Stuffing Attack\u00a0<\/b><\/h3>\n
The VFEmail Incident\u00a0<\/b><\/h3>\n
\n
The Collections #2-5 Data Leak<\/b><\/h3>\n