ALL >> Computers >> View Article
The Great Russian Hacker Heist & The “shadow Id” Problem It Exposed
Total Articles: 35
On Monday the world learned that a small crew of Russian hackers stole 1.2 billion internet passwords. Before digging into what this means to your enterprise’s information security posture, I must first commend Nicole Perloth and David Gelles from the New York Times for their excellent journalism in breaking this important story.
So…over a billion passwords have been stolen. Chances are you or someone you know is on the list of compromised passwords. Time to call up grandma and tell her to change her AOL password. Joking aside, this is a serious breach and it’s important to understand the risk to information security at your enterprise and what you can do about it.
3 aspects of potential risk to your enterprise
Customer ID: If your enterprise is one of the 450,000 sites that was exploited during this breach, you have a number of issues to consider including review of vulnerability assessment practices, compliance regimes, and legal fees. Not surprisingly given the sensitivity of customer personal information exposed, a recent Poneomon study finds that the average cost to an enterprise for each data breach is $3.5M. Time to pull your wallet out!
Shadow IT: In this instance, your enterprise has not been breached, but a Cloud service that your enterprise uses has been breached. Determining the extent of vulnerability is difficult if you don’t know which services your employees are using. Your challenge starts with keeping abreast of “Shadow IT” and all the breached services that could impact your business. Setting up alerts and workflows in case a breach is disclosed, monitoring shadow IT proliferation, and accessing 3rd party intelligence sources to quantify the surface area of risk (including specific employee credentials compromised at these partner/vendor sites) are all helpful measures to take. This situation can be mitigated with the use of enterprise identity and SSO with sanctioned Cloud Security services.
“Shadow ID”: Here, your enterprise and the corporate cloud services in use have not been breached, but you may still have a “Shadow ID” problem wherein your employees have used their corporate identities (typically by registering in a site with a corporate email ID) when registering at 3rd party sites. Skyhigh’s data indicates that more than 80% of enterprises have this “Shadow ID” problem. This rampant proliferation of Shadow ID in and of itself may not be an “enterprise problem” – except that many studies have indicated that 30% of users typically reuse passwords and a significantly larger percentage of accounts can be compromised if a valid password from any environment is known. Hackers may try to login to the enterprise VPN or corporate mail with a user’s credential obtained from a breach. Even if the password is not reused by the user, the hacker will have a much better chance of guessing the right one.
The dark side of the cloud
Skyhigh identifies compromised corporate credentials and the source of that information for sale in the black market so that we can inform our customers of the extent of the “Shadow ID” problem in their organization. In doing so we’ve learned a lot of interesting lessons about what type of private corporate data is available to criminals for purchase in the online black market. Here’s what we have found.
Compromised credentials are commonplace
80% of F100 enterprises have a “shadow ID” problem where credentials associated with a corporate identity are available for purchase online.
50% of companies have a compromised corporate identity with an associated credit card number and billing address available for purchase online.
30% of companies have at least one compromised corporate credential with an associated PayPal or other bank account information available for purchase online.
We discovered an average 1,156 corporate credentials per enterprise available for purchase online.
Three ways to address “Shadow ID”
Here are three ways you can protect your company’s data stored in the cloud services from hackers using stolen corporate credentials:
Continuously monitor for “Shadow IT”, “Shadow ID” and compromised IDs. Notify individuals with compromised accounts so they can update their passwords and audit their recent account history to determine if a breach occurred.
Leverage machine learning algorithms that establish baseline behavior for every user and every Cloud Security service to identify any anomalous activity indicative of security breach or insider threat.
Require the use of corporate identity and SSO to ensure that credentials are not stored in 3rd party services. In addition, require enforcement of identity and context based access control of cloud services.
Lauren Ellis is a research analyst covering the technology industry’s top trends & topics, focusing on Cloud Security, Cloud Computing, Data Loss Prevention etc.,
Computers Articles1. Exchange Database Recovery Software
2. 7 Powerful Tips For Persuasive And Captivating Interactive Presentation
Author: Amit Sahoo
3. Creating The ιστοσελιδα Properly For Establishing The Brand Information
Author: parveen kumar
4. Kind Of Infections A Pc Is Prone To
Author: Newlite Technical services
5. Samsung Screen Repairs, Nationwide Repairs, 60 Min Repair Manchester
Author: samsung repairer
6. Mac Book Pro Repair Andheri Is The Best Solution For Your Damaged System
Author: Mike Rakhangi
7. Planning To Hire An Odoo Developer? - A Must Read
Author: Jay Vora
8. Contact Pc Repairs Maroochydore Experts To Resovle Software Or Hardware Issues Of Your Computer
9. Tips To Choose A Good Computer Repair Service Provider
10. 2. Anniversary Update Leads To Some Technical Issue In Windows 10
Author: Easton Finn
11. 10 Easy Steps To Clean Your Infected Computer
Author: Newlite Technical services
12. How To Resolve Excel File Password Problem And Recover My Original Excel Worksheet Password
13. Experience The Best Services
Author: Paul Wright
14. Institute Of Animation And Vfx
15. Remote Access Quickbooks: More Freedom And Flexibility To Manage Your Finances
Author: Amenda Ray