{"id":5244,"date":"2021-02-10T16:20:47","date_gmt":"2021-02-10T20:20:47","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=5244"},"modified":"2021-02-10T16:20:47","modified_gmt":"2021-02-10T20:20:47","slug":"findings-f5-2021-credential-stuffing-report-with-commentary","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/","title":{"rendered":"Findings: F5 2021 Credential Stuffing Report with Commentary"},"content":{"rendered":"

\"Findings:<\/p>\n

Recently, F5 released its <\/span>2021 Credential Stuffing Report<\/span><\/a>, exploring one of the most commonly-used and largely successful tools in the hackers\u2019 arsenal. While breach volumes seem on the decline, annual credential spill incidents nearly doubled over the course of four years. According to the 2021 Credential Stuffing Report, a credential spill is \u201ccyber-incident in which a combination of username and\/or email and password pairs becomes compromised.\u201d<\/span><\/p>\n

The report by F5 also notes that, while industry awareness of cybersecurity best practices<\/a> continue to improve, password security remains poor. Many businesses still store their password in plaintext, which proves increasingly unsecure. The median time to discover a credential spill between 2018 and 2020 was 120 days; the average time to discovery was 327 days.\u00a0<\/span><\/p>\n

These numbers don\u2019t bode well for password security for businesses. To gain other perspectives, we consulted with a few cybersecurity experts. Here\u2019s what they had to say:\u00a0<\/span><\/p>\n
Widget not in any sidebars
\n

Commentary on the F5 2021 Credential Stuffing Report<\/b><\/h2>\n

Saryu Nayyar<\/b><\/h3>\n

Saryu Nayyar is the CEO of <\/span><\/i>Gurucul<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

\u201cThe recent report from F5 on the state of credential theft volumes and their use in cyberattacks over the last four years is interesting and shows many organizations are still not following industry best practices for securing user credentials.<\/span><\/p>\n

\u201cCredential theft can have long-reaching and expensive aftereffects in lost revenue, incurred mitigation costs, and loss of customer trust – which is itself difficult to put a price on.\u00a0 Preventing or blunting attacks before they lead to a major breach is generally much less expensive than suffering the fallout from an attack. By following best practices and making sure the organization’s security stack is up to date, including MFA, security analytics, and other technical measures, organizations reduce their risk of being breached in the first place, and can prevent extensive damage.\u201d<\/span><\/p>\n

Chlo\u00e9 Messdaghi<\/b><\/h3>\n

Chlo\u00e9 Messdaghi is Chief Strategist at <\/span><\/i>Point3 Security<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

\u201cThese statistics paint a useful picture of the crisis we\u2019re in, but they also show that too many organizations are still running ad hoc and expanding the problem because they don\u2019t know in a timely way when breaches happen. There are four simple steps that every organization should take. The first is passwords \u2013 company and customer account passwords should never have less than 20 characters because they\u2019re just too easy to crack. Companies need to enforce stricter password policies, both for the good of the organization and for their customers\u2019 sakes. Everyone should be using password managers at this point, and also be warned never to reuse a password on or from any other account. It\u2019s just too easy for passwords to get stolen and exploited, and yet people still reuse their favorite passwords across accounts.<\/span><\/p>\n

\u201cSecond, MFA needs to be enabled and required, and not just SMS, but MFA that allows the user to take advantage of an MFA app. Third, security must be embedded during site development. If an organization is using open source code, they need to invest in scanning to ensure that it\u2019s safe and remember that anything you use for free needs an investment behind it. Last, invest in detection tools, backups, and encryption \u2013 all of which are essential and should be universally employed at this point.\u201d<\/span><\/p>\n

Garret Grajek\u00a0<\/b><\/h3>\n

Garret Grajek is CEO of <\/span><\/i>YouAttest<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n

\u201cThe report states: \u2018Organizations are also poor at detecting breach attempts: median time to discovering a credential spill between 2018 and 2020 was 120 days, while the average time to discovery was 327 days.\u2019<\/span><\/p>\n

\u201cI think this is the key point. Hackers are going to find a vulnerability somehow, someway – we are all being scanned. And once that flaw is found, e.g. an unpatched server, a weak password, an open network device – the hacker will be on our systems. From there, we MUST be able to detect their actions. The known pattern of behaviors of attackers makes identifying compromised credentials (hacked accounts) possible. We know that a hacker is going to want to move around the network (lateral movement) and escalate their privileges of the overtaken account (privilege escalation). This latter action, privilege escalation, is what hackers use to take normal “user” accounts and turn them into “admin” accounts. This allows them access to more networks, more servers, and more data.<\/span><\/p>\n

\u201cThese privilege escalations are detectable if the enterprise is conducting regular and triggered access and privilege reviews, and is what cloud identity governance does for the enterprise.\u201d<\/span><\/p>\n

<\/div><\/p>\n

Thanks to these cybersecurity experts for their time and expertise on the F5 2021 Credential Stuffing Report. For more information, check out our Identity Management Buyer\u2019s Guide<\/a>.\u00a0<\/span><\/p>\n
Widget not in any sidebars
\n","protected":false},"excerpt":{"rendered":"

Recently, F5 released its 2021 Credential Stuffing Report, exploring one of the most commonly-used and largely successful tools in the hackers\u2019 arsenal. While breach volumes seem on the decline, annual credential spill incidents nearly doubled over the course of four years. According to the 2021 Credential Stuffing Report, a credential spill is \u201ccyber-incident in which […]<\/p>\n","protected":false},"author":41,"featured_media":4622,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[142,1212,16,112,1625,1522,1204,76,425,1273,91,1565,1626],"acf":[],"yoast_head":"\nFindings: F5 2021 Credential Stuffing Report with Commentary<\/title>\n<meta name=\"description\" content=\"Recently, F5 released its 2021 Credential Stuffing Report, exploring one of the most commonly-used and largely successful tools in the hackers\u2019 arsenal.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/\",\"name\":\"Findings: F5 2021 Credential Stuffing Report with Commentary\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg\",\"datePublished\":\"2021-02-10T20:20:47+00:00\",\"dateModified\":\"2021-02-10T20:20:47+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"Recently, F5 released its 2021 Credential Stuffing Report, exploring one of the most commonly-used and largely successful tools in the hackers\u2019 arsenal.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg\",\"width\":800,\"height\":400,\"caption\":\"Why Identity Governance Takes on New Importance in Remote Workplaces\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Findings: F5 2021 Credential Stuffing Report with Commentary\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Identity and Access Management Solutions | Solutions Review\",\"description\":\"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Findings: F5 2021 Credential Stuffing Report with Commentary","description":"Recently, F5 released its 2021 Credential Stuffing Report, exploring one of the most commonly-used and largely successful tools in the hackers\u2019 arsenal.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/","url":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/","name":"Findings: F5 2021 Credential Stuffing Report with Commentary","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg","datePublished":"2021-02-10T20:20:47+00:00","dateModified":"2021-02-10T20:20:47+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"Recently, F5 released its 2021 Credential Stuffing Report, exploring one of the most commonly-used and largely successful tools in the hackers\u2019 arsenal.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg","width":800,"height":400,"caption":"Why Identity Governance Takes on New Importance in Remote Workplaces"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/findings-f5-2021-credential-stuffing-report-with-commentary\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Findings: F5 2021 Credential Stuffing Report with Commentary"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Identity and Access Management Solutions | Solutions Review","description":"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/identity-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5244"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=5244"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/5244\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/4622"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=5244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=5244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=5244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}