The line world has a password problem starting with the fact that the No. 1 computer password employed by job users is, wait for it: “Password1″. Unfortunately, that’s simply the about cringe-worthy example of bad enterprise security cited by Trustwave in its late released Global Security Account for 2012.
Why “Password1″? Because “it satisfies the default Microsoft Active Directory complexity setting,” the IT security enquiry house noted. In other words, it’s became a capitalized letter, a number, and the requisite routine of characters to qualify under basic password security settings.
The password problem is just one of the security issues businesses are feeding up against in an increasingly hostile cyber-world, granting to Trustwave. Other fundamental findings related to hacking incidents and intrusion investigations at companies researched by Trustwave include:
Customer records remained a valuable target for attackers, making up 89 percentage of breached data investigated.
For the minute year, the food and potable industry made up the highest pct of investigations at nearly 44 percent.
Industries with franchise models are the young cyber targets: more than a tertiary of 2011 investigations haped in a franchise business.
In 76 percentage of incident response investigations, a tertiary party responsible for system support, maturation and/or maintenance of occupation environments entered the security deficiencies.
Law enforcement detected more breaches in 2011up from 7 percent in 2010 to 33 percentage in 2011.
Data harvesting techniques proceeded to target data “intransit” within victim environments showing up in 62.5 percent of 2011 investigations.
Anti-virus detected less than 12 pct of the targeted malware samples collected during 2011 investigations.
For Web-based attacks, SQL injection remains the act one attack method for the quaternary year in a row.
In addition to detailing the issues above, Trustwave elaborates at length on password issues in job55 IT environments. Users “are finding creative ways to override” corporate IT policies on passwords, allotting to the report.
These risk-increasing workarounds include positioning usernames equally passwords, making simple, frequently numerically progressive (and hence predictable) changes to passwords, and opting for the simplest possible variations to gather complexity requirements, “such as capitalizing the first letter and adding an exclamation channelize to the end” of the password.
A big problem for job users is that IT policy requiring that passwords be complex and changed ofttimes not to advert environments that necessitate several different passwords is making it more hard to commit those passwords to memory.
Hence the workarounds users employ, Trustwave notes, while many occupation users indite down their passwords where they can exist revealed evening on the selfsame computers they’re meant to protect.
And eve if a fellowship has a good password policy that’s adhered to by its employees, that isn’t the close of it. Trustwave warned in the account that keystroke logging software is relatively slowly for hackers to deploy and social engineering techniques for getting employees to disclose how to access IT assets remains a big problem.
