Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
ATO

Planning to Prevent Account Takeover

When planning an organization’s security architecture, there has commonly been a focus on traditional approaches like managing firewalls and ensuring systems are patched. While these are critical components of any organization’s best security practices, there have been several key areas of security planning that have been overlooked.

One such area of planning is the issue of password hygiene and account takeover prevention. Given the fact that compromised passwords account for a majority of all data breaches, it is worth looking at how they fit in with other major areas of security planning to ensure an organization is doing everything in its power to prevent data breaches.

Compromised Credentials Need to be Identified

Account takeover has become a serious issue even for organizations that have not suffered a major data breach. The vulnerability is due to password reuse by end-users who may have been part of a third-party data breach. To help eliminate the issue, organizations need to have a way to identify when user credentials have become compromised.

Many users will reuse the same password for personal accounts that they use for their business accounts. If that password becomes compromised through their personal accounts, it then presents a risk for any business accounts associated with that user since threat actors have been known to target businesses using lists of passwords taken from compromised personal accounts.

If an attacker successfully compromises one of that user’s business accounts, then they have access to everything that user has. To stop these types of attacks, an organization should have proper password policies in place. This includes ensuring that users are doing things like creating passphrases rather than just passwords, avoiding commonly used passwords, and forcing them to have a significantly different password from any previous password when a new one is created.

A highly effective way to prevent account takeovers is to make sure that there is a way to identify any potentially compromised passwords being used by end-users. Checking passwords with tools such as Enzoic at the time of password creation can ensure that a compromised password never has the chance to be put into use in the first place.

Implement the Principles of Least Privilege

Following along with the idea of preparing for an account takeover scenario, the next area of planning that should be accounted for is making sure that proper policies are in place following the principle of least privilege.

Organizations should only be giving their end-users permission to data that is directly relevant for their job and nothing more. This ensures that in the event something like an account takeover does potentially happen the attacker only can access a very limited set of the organization’s data and not potentially open them up to a much larger and more costly data breach.

Additionally, any user that does have an account privileged to sensitive data needs to have additional layers of monitoring added to ensure they are not working improperly with the data they have access to. These tools could include insider threat monitoring systems or data loss prevention solutions which can watch for improper use of certain data sets.

End-User Education is Important

Combined with the previous two areas of planning another major concern for organizations should be on the training of their end-users. While some account takeover scenarios come from issues of password reuse there are a significant number of these scenarios that come from end-users giving up their credentials to phishing and social engineering attacks.

Most end-users that end up becoming a risk to organizations aren’t doing it intentionally. They just simply don’t know better. If end-users understand what these types of threats are and how to identify and properly respond to them then they will be able to significantly reduce risk to the organization of a breach happening because of these types of attacks.

Multi-Factor Authentication is Essential

Another way that organizations can help avoid the issue of account takeovers is by implementing multi-factor authentication for access to any sensitive data. This way even if a threat actor has gained access to a compromised password, it will be more difficult for them to take over an account and expose private data since they will not readily have access to the additional pieces of authentication.

Conclusion

While focusing on traditional methods of securing an organization is recommended and cannot be overlooked, it is essential to also be incorporating newer policies that can greatly increase overall security without adding much additional overhead or work for IT staff.

Implementing proper password use policies, following principles of least privilege, adding multi-factor authentication, and educating end users are all relatively quick and inexpensive ways to boost security. Added all together they will greatly decrease the risk of an account takeover and the headaches that come along with it from a data breach.

ATOpassword reusePassword Security

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (28)
  • Active Directory (44)
  • all posts (152)
  • Continuous Password Protection (24)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (21)
  • Cybersecurity (66)
  • Data Breaches (31)
  • EdTech (3)
  • Enzoic News (18)
  • Financial Services Cybersecurity (5)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (28)
  • Password Security (30)
  • Password Tips (51)
  • Regulation and Compliance (11)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • CISA: The Risk of MFA Without Improving Password Security
  • It’s W0rld P@ssw0rd D@y!
  • Tackling Cybersecurity Vulnerabilities in School Systems  
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website