What’s behind PCI’s New MFA Requirements?

Requirement 8.3 of the PCI DSS 3.2 goes into effect today (Feb 1, 2018), making MFA (multi-factor authentication) a requirement for every organization involved in payment card processing. Many have implemented MFA ahead of the requirement, however a look at the PCI’s multi-factor implementation guidance highlights some considerations, particularly around passwords that may otherwise be overlooked. 1. Multi-factor means multiple …

The Outsized Risk From Small Data Breaches

Most attention is given to data breaches counted in the tens or hundreds of millions, but there is also a continuous stream of small data breaches that make no headlines but present outsized risks to individuals and organizations. In a recent analysis by Enzoic of breach data collected from the Internet and Dark Web, a full 90% of credential exposures …

password reuse is bad

The Magician’s Handkerchief of Password Reuse

Yesterday I received an email in my inbox from a prominent gaming website, indicating that my account had been disabled due to “suspicious activity” and that I would need to reset my password. They then carefully explained that this was not due to a breach of their site, but instead likely due to my account credentials having been exposed either …


NIST Special Publication 800-63 is Final

The big changes to NIST password recommendations we’ve been talking about are now official: NIST 800-63 is final. It’s important to know that this overhaul is about more than just passwords. It’s a full reworking of digital identity guidelines with a suite of new documents and a flexible approach to using them.

Evolving Password Based Security

Evolving Password Based Security to Fight Compromised Credentials Attacks

The continued barrage of reports about data breaches and account hijacking, make it painfully clear that the way organizations are managing password-based security is missing something. When we look at how cybercriminal tactics have evolved, and how compromised credential attacks have impacted these methods, one answer to the problem of the password becomes clear.

NIST compromised credentials

Looking Closer at NIST Password Guidelines for Checking Compromised Credentials

NIST suggests passwords should be screened against commonly-used, expected, or compromised passwords. This is intended to ensure passwords are not found in common cracking dictionaries that would make them easy to guess. These checks can occur at account creation and password reset. But then what? How do you know if they are still safe after time?


LastPass Selects Enzoic for Compromised Credential Screening

PasswordPing announces a new partnership providing LastPass customers with a quick and easy way to screen for individual and enterprise user credentials against a database of billions of compromised credentials. With PasswordPing, LastPass is able to identify high risk end users and put additional security measures in place, such as email alerts and real-time in-product notifications, to block account hijacking attempts and other fraudulent activities.

LeakedSource Shut Down

LeakedSource Shut Down by DOJ

Last week, a breach notification site named LeakedSource was allegedly shut down by US law enforcement and much of their equipment confiscated. The reasons why they may have been targeted by law enforcement are unknown, although it’s possible to hazard some guesses as to why. Were they White Hat, Black Hat or Grey Hat?