Passwords: The Gift That Keeps on Giving

In honor of World Password Day on May 2^nd, government entities and tech giants are making big moves to raise awareness and promote secure data protection mechanisms. In this article, we spotlight recent news around the security and advancements of robust password policies across the globe.
 
The Change Healthcare Cyberattack: Lessons Learned the Hard Way

During a U.S. Senate hearing on May 1^st, UnitedHealth CEO, Andrew Witty, acknowledged the root cause of the Change Healthcare cyberattack. Witty attributed the assault from earlier this year to a security lapse and emphasized the importance of multifactor authentication, a standard practice across UnitedHealth, which could have prevented the $872 million breach. Hackers gained access through compromised credentials, unleashing a ransomware storm that disrupted payment and claims processing nationwide.

nGuard recommends services like vulnerability scanning, penetration testing, and managed SIEM, all of which could have detected the weakness exploited in this attack, ensuring a proactive defense against similar incidents in the future. Additionally, nGuard’s cybersecurity incident response (CSIR) services assists organizations in rapidly identifying and containing breaches, minimizing the impact on critical systems and data.
 
Advancements in Authentication: Google’s Passkey Adoption

In celebration of World Password Day, Google has announced their successes with passkey adoption and utilization. Claiming passkeys have been “used more than one billion times by 400 million Google accounts” and is “50 percent faster”, this milestone reflects a shift towards more secure authentication methods. The conversion will also expand “Cross-Account Protection”, making it even more difficult for cybercriminals to gain initial traction by notifying users of “suspicious events with apps and services” connected to their Google Account. As passwords prove vulnerable to phishing attacks, passkeys offer a promising alternative with increased defenses.

Our services, including penetration testing, and strategic security assessments, can assess the efficacy of authentication mechanisms and security policies to identify gaps and make tailored recommendations to your organization’s needs.
 
Regulatory Initiatives: The UK Bans Default Passwords

On April 29^th, the United Kingdom became the first country to ban default passwords for IoT devices. While many other entities have taken steps in this direction, this new regulation signifies a more proactive approach to upholding high cybersecurity standards and paving the way for others to do the same. Currently, the United States does not have a federal law for securing IoT devices, although the National Institute of Standards and Technology (NIST) has guidelines for IoT cybersecurity. Governing bodies and manufacturers must prioritize initial security protocols to mitigate risks posed by default credentials.

Our password database audit can assist organizations in testing the strength of encrypted passwords to safeguard against potential breaches.
 
Combatting Sophisticated Phishing: Insights from LastPass Incident

CryptoChameleon, a sophisticated phishing campaign, is now targeting LastPass users to unveil their master passwords. First, victims receive a robocall which ultimately ends in receiving a follow up call from a live customer service representative that asks questions to officially “close a ticket”. During the call, the scammer provides a reassuring spiel before sending over a link via email to a copycat LastPass site. Once the user enters their credentials, the “agent” immediately has the ability to permanently disable access for the user, and view all of their linked accounts and passwords. LastPass is providing details and updates of operation to promote awareness among users. The evolving nature of social engineering techniques pose significant challenges to traditional security measures, emphasizing the need for heightened awareness and proactive defenses.

nGuard’s simulated and targeted spear phishing social engineering campaigns, security awareness training, and cybersecurity incident response capabilities equip organizations to detect and respond swiftly, minimizing potential damages, and shielding users from advanced phishing and persistent threats.
 
Embracing Passkey Technology: Microsoft’s Integration

Like Google and Apple, Microsoft has announced the integration of passkey technology for World Password Day. This conversion, taken by world-renowned tech giants, signifies the push for enhanced security and user convenience. Since passkeys cannot be stolen or forgotten, they offer a seamless authentication experience while decreasing dangers associated with traditional credentials and will even be coming soon to associated mobile apps in the “coming weeks”.
 
In light of recent cyber threats and initiatives, it is evident that safeguarding users from vulnerabilities surrounding passwords is paramount across the globe . From multifactor authentication to security awareness training to security information and event management (SIEM), password protections are becoming increasingly important. As advancements in authentication and lessons learned pave the way for solidifying security, nGuard’s expertise in strategic security assessments, penetration testing, phishing simulations, and holistic policy development, ensures institutions can adapt and thrive in the tumultuous cyberworld.