A study from Specops Software, released on May 14, found some items that should probably stay out of the new-hire welcome package: easy-to-guess, temporary passwords.
After scanning over 651 million malware-compromised credentials over the last year, a team at the password security company found 120,000 that contained terms common to new-hire credentials—logins like “user,” temp,” “welcome,” and “change.”
Compromising common starter passwords allows attackers to potentially get around safeguards like multi-factor authentication (MFA) and to potentially get first access into employee-issued services.
“Before you can set MFA, you need to log in the first time with a password to then configure MFA. So [new-hire accounts] are quite a juicy target for any threat actors, especially if they’re pre-provisioned before the user starts,” Darren James, Specops senior product manager, told IT Brew.
Read more here.—BH
|