Beyond Identity

beyondidentity

No matter the level of security knowledge you possess, there are a few simple actions that will immediately improve your software security. These are low-hanging security fruit that still isn’t picked up by many companies. Explore the common security mistakes others have made and learn valuable lessons from them. Mistake #1: Not verifying login credentials Equifax, the credit reporting company, , specifically on its website in Argentina. Researchers at Hold Security, a cybersecurity firm, discovered this security flaw and were equivalents of over 100 individuals. for a non-US database used the generic username and password "admin" able to access personal employee information, including names, emails, and Social Security Lesson learned Ensure that all admin accounts don’t have default login credentials or easy-to-break credentials such as login: admin, password: admin. Mistake #2: Keeping sensitive data in code The St. Louis Post-Dispatch reporter discovered that of a website run by the state education department. The newspaper informed the state about the issue. However, the Governor of Missouri wasn’t very grateful about it calling the newspaper's actions hacking… the Social Security numbers of Missouri teachers were embedded in the HTML source code Lesson learned Check out if test credentials or sensitive data arent’s hard coded in the frontend code comments. Mistake #3: Easy-breaking CI/CD credentials According to the Business Leader, . Hackers commonly use default credentials, including default Raspberry Pi credentials and credentials used on Linux machines, to gain unauthorized access to servers. hackers , particularly the use of regular or default passwords gain access to businesses' servers by exploiting poor security practices Lesson learned If you use CI/CD providers and other external tools or dashboards, ensure that any default accounts don’t have easy-breaking credentials. Mistake #4: Checking in secrets in repositories Researchers at CloudSek discovered that . The researchers found that approximately 0.5% of the 8,000 apps they studied contained hardcoded private keys for AWS APIs. , exposing user data and corporate information popular mobile apps are leaking Amazon Web Services (AWS) keys Lesson learned Verify if any secrets e.g. AWS keys, passwords, etc. aren't checked-in in repositories. Secret leak detection tools that you can implement right away: – available for free as secret leaks scanning tool in all Gitlab plans. Gitleaks – it works as a Chrome extension that shows secret leaks on websites. TruffleHog – secret scanning alerts for GitHub repositories. It’s free on all
public repositories. GitHub Secret Scanning Mistake #5 Exposed unwanted ports . The list contains names of individuals prohibited from flying due to suspected terrorist ties or other security concerns. An airline employee discovered the unsecured server and reported the breach to the Department of Homeland Security. A confidential and sensitive U.S. government watchlist, known as the no-fly list, was leaked after being left unsecured on an airline server Lesson learned Make sure that the services you use don’t have any unwanted exposed ports. Tools that scan open ports: – a free search engine that could be used for Infra reconnaissance. Censys – a paid alternative to Censys. Shodan Mistake #6 Taking keys from tutorials granting remote control over car functions. . A software developer identified a flaw in the encryption algorithm used for the vehicle's communication with its mobile app. Exploiting this vulnerability, unauthorized access was gained to the car's systems, enabling actions like unlocking doors and starting the engine. Hyundai's vehicle encryption was successfully cracked Hyundai used a public-private key pair from a tutorial and placed the public key in its code Lesson learned Don’t use public keys from any tutorials. Mistake #7 Forgetting to withdraw access A study by Beyond Identity revealed that around , with over 41% of them admitting to sharing their login credentials. to their past workplace accounts and emails 25% of former employees still have access Lesson learned Regularly withdraw access to any tools, from ex-employees or people who
don’t need them, to reduce the attack surface. Consider using a Single Sign-On for all your services, for example, Google Sign-in. What other mistakes you shouldn’t make? and get access to the best security practices and tools. Download our free ebook

7 Security Mistakes Others Made So You (Probably) Shouldn’t

If your company is like most, then the year 2020 threw you some real unexpected curveballs and you’re still trying to recover. From offices closing and production shutting down, to implementing remote work policies and procedures, 2020 brought huge and sudden changes to businesses, worldwide. Not all the changes were negative ones. In fact, employers and employees alike are generally pleased with the new standard of remote work. Employees are happy to work from home or other remote locations and companies are benefiting from lower overhead costs. However, this scenario has presented businesses with some new and pressing challenges in the way of cybersecurity. Unfortunately, most businesses were simply unprepared for the sudden shift to remote work, and IT departments were not only overwhelmed but ill-equipped to handle the realities of a remote workforce. With 56% of employees using personal, rather than company devices, and working from home networks with unsecured or unstable WiFi, cybersecurity was bound to become a huge issue. On top of that, the legacy systems that companies relied on for in-house connections were not built to handle the large number of remote connections suddenly thrust upon them. All of this made fertile ground for cyber criminals to glean information. The FBI reports that cybercrime rose by 300% in early 2020. Targeted attacks on remote employees rose by 5x within the first 6 weeks of lockdown, and this led to 20% of businesses suffering a cybersecurity breach which could be linked back to their remote employees. Sixty percent of companies have attempted to combat security risks with the implementation of multi-factor authorization, but this kind of security just isn’t cutting it. Multi-factor authorization (MFA) is almost a great solution, but having a combination of passwords and other authentication methods still leaves too many gaps; largely due to users reusing their credentials for multiple applications. Although an MFA can prevent 95% of bulk phishing attacks and over 75% of targeted attacks, they can’t prevent users from using poor judgment in login creations. In fact, 63% of data breaches exploit weak and reused credentials, and in 2020, 500,000 Zoom accounts were compromised by credential stuffing (using credentials collected during previous attacks.) The real solution to this problem lies with the complete elimination of passwords. Beyond Identity is a security system that replaces passwords with biometrics and cryptography.  Its risk-based authentication checks every user and every device for risk signals, and the frictionless login means that there are no out-of-band messages for hackers to intercept. In order for IT departments to meet the new demands of remote connections, is a no-brainer. passwordless security

Stories, News & Mentions about BEYONDIDENTITY

Beyondidentity’s Stories on HackerNoon