Fighting credential theft with automation: the answer to the CISO's headache

OP-ED · 15 NOVEMBER 2022

By Jérôme Beaufils · Lire en français

More than 24 billion stolen credentials are available on the Internet and the Dark Web.

Their exploitation by cybercriminal groups is the number one attack vector, far ahead of phishing and vulnerability exploitation.

Using these credentials, attackers take control of user accounts and expose organisations to breaches, ransomware and data theft.

Although CISOs are aware of this threat and often have tools to reduce the risk, the news shows that the way these tools are applied falls well short.

A structured, continuous approach reduces risk exposure, but it represents too heavy a workload for security teams that are often stretched.

Automating the detection and identification of real risks to the organisation is the only response suited to the dynamics of cyber threats.

The nature of the risk

80% of web application breaches involve compromised identities.

Attackers use techniques such as social engineering, brute force and buying credentials on the Dark Web to compromise identities and gain access to organisations' resources.
They often take advantage of the following weaknesses:

The same password used across several applications
The same password used for personal and work applications
Passwords stored in browsers
Password reuse or long password lifetimes
Unused credentials (former employees, contractors, service accounts, etc.)
Passwords shared between different users

The main challenge for the organisation is that attackers only need one valid credential to get in.

Mitigating the risk

To reduce their risk exposure, organisations must focus on what is exploitable from the attacker's point of view.

An effective methodology is based on the following steps:

1. Collect stolen credentials

To start solving the problem, security teams need to collect data on credentials stolen from various places on the web and on the Dark Web.

Tools such as HaveIBeenPwned or the one from the Hasso Plattner Institute are useful.

This step provides an initial picture of the situation and identifies the individual accounts that need updating.

2. Identify the real exposure risk

Once the data has been collected, security teams must determine which credentials can actually be exploited.

To do this, they must use techniques similar to those of attackers:

Check whether the credentials grant access to external resources, such as web services and databases
Try to crack captured password hashes
Validate matches between stolen credentials and the organisation's identity management tools, such as Active Directory
Test variants to identify new identities that could be compromised, since users generally rely on the same password patterns

3. Reduce the exposure risk

After validating which stolen credentials really expose the organisation, security teams must take targeted measures to mitigate the risk.

For example:

Remove leaked inactive accounts from Active Directory
Trigger password changes for active users
Review password management processes and policy (hardening, lifecycle)

4. Set up a continuous validation approach

Attackers' techniques, like organisations' attack surface, are constantly changing, especially in terms of user accounts.

A one-off effort to identify, verify and reduce credential exposure is therefore insufficient.

To combat this risk over time, organisations must adopt a continuous approach.

However, the workload these manual actions represent is too heavy for security teams with limited resources.

The only way to manage the threat effectively is to automate the validation process.

Automation

Since 2021, Gartner has introduced this automation through the concepts of "Automated Penetration Test and Red Team Tools" and "External Attack Surface Management".

These concepts bring together techniques aimed at continuously identifying the risks that expose organisations' attack surface, so that remediation work can focus on proven risks.

Among the players, Pentera is today the leader in automated security validation.

Using the latest and most advanced attack techniques, its platform automatically and continuously carries out ethical attacks to reveal static and dynamic vulnerabilities.

These tests are run from both outside and inside the organisation, covering the entire attack surface.

Among its features, the "Leaked Credentials" module automates the steps of discovering stolen credentials and checking the exposure they represent for the organisation:

On external services (SaaS, websites, email)
On internal services (applications, workstations, servers, infrastructure components).

The results of these investigations show the complete attack vectors along with a description of the remediation actions for security teams to carry out.

Integration with SIEM or ITSM tools makes it possible to embed this process in the overall cybersecurity risk management process.

These technologies represent the future of threat monitoring, detection and prevention.

Acknowledgements: Eli Domoshnitski, Product Manager, Pentera

💡 To discover Pentera automated security validation, nothing beats a demo! 👀 Save the date 📅 👇

Book a demo →

👀 To find out more about Pentera 👇

Learn more →