Keep Watch On Accounts For Stolen Passwords

Log management and a well-refined ruleset can help companies pinpoint suspicious activity on accounts that suggest a password compromise

In the past week, three major online consumer services have acknowledged that their systems were breached and passwords leaked. The litany of incidents is a good reminder that companies should take another look at how they are managing and monitoring the access to their systems.
On Wednesday, social network LinkedIn confirmed that some of the 6.5 million password hashes leaked online belonged to users of its social network. Researchers have confirmed that the passwords
were not mathematically hashed
using an additional seed, or salt, allowing researchers to easily decrypt some 60 percent of the passwords in 48 hours. Two other companies, online dating service eHarmony and music service Last.fm,
reportedly confirmed
that some users account credentials had also been leaked or stolen.
All three incidents demonstrated that the companies failed to monitor properly for suspicious access to their systems and password files, says Nick Percoco, senior vice president at security service provider Trustwave and the head of the companys SpiderLabs.
All of these organizations found out about the leak because someone reported it to them, Percoco says. Someone posted it on the online in a forum. And, if you are at LinkedIn, you heard about the incident at the same time that some like me did.
[A hacker claims to have infiltrated the personal Hotmail and Dropbox accounts of Republican presidential candidate Mitt Romney, after guessing his favorite pet security question to change the password. See
Hacker Says He Accessed Pair Of Presidential Hopeful Romneys Online Accounts
.]
Its not an uncommon problem. More than 90 percent of breaches were reported to a company by a third party, according to Verizons 2012 Data Breach Investigations Report. Moreover, 84 percent of breaches left signs of the compromise in log files, and all but 3 percent of the breaches could have been stopped by simple or intermediate controls, the report stated.
Mine, your, logs
The Verizon data has a simple lesson for companies: Organizations that monitor logs for the right events will be able to catch suspicious accesses in their systems.
Whats suspicious? That depends on your users and their use cases, says Joe Siegrist, CEO of online password service LastPass. Employees who suddenly log in from another country, use a different device, attempt to access restricted systems or are using a proxy service should all raise a red flag, or at least contribute to some cumulative factor of suspicion.
If both their activity is an outlier as well as other elements you are tracking, ... then you should be more likely to suspect fraud, says Siegrist. If you have an employee that normally does X, Y, and Z, and they are coming from a new location and doing things that they might not normally do, that should raise suspicions.
The least expensive way to monitor for such anomalies is to monitor log files and filter events using rules to detect abnormal behavior by users. Defining abnormal can be difficult, however. Thats where systems that create fingerprints of standard users can come in handy. Alternatively referred to as adaptive analytics or adaptive authentication, the technology was first used by financial institutions to detect fraud on credit card accounts.
Adaptive analytics is a state engine that watches what users are doing, and making sure that their patterns of behavior makes sense, says Darren Platt, chief technology officer with Symplified, an identity and access management company. Its not just the applications they access, but the locations they are accessing from and what devices they are using when they access.
Dont just watch, do more
Companies should not stop at monitoring their access logs for signs of password abuse, however.
Starting with education, companies should teach their employees that each password should be complex and used only once. Companies should then create policies to enforce their security controls, including locking out accounts after a certain number of password attempts and adding authentication methods if anything appears suspicious.
In addition, companies should consider adopting two-factor authentication to lessen the chance that a compromise password will lead to a compromise of the corporate network.
Finally, companies that are monitoring their logs should make sure they have updated any detection rules for account access.
Hackers are obviously going after password files and companies need to have systems in place that are monitoring the files, says Trustwaves Percoco. Companies should take the time to tune them, so they can proactively see these attacks happening.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Keep Watch On Accounts For Stolen Passwords