Anniversaries remind us to review identity risks

Two anniversaries this month – World Password Day and the fifth anniversary of the WannaCry ransomware attack – were a timely reminder for ordinary citizens and organisations to stop and think about the risks associated with digital identities and whether their security controls are up to date.

World Password Day – stop and reflect

World Password Day is a time to stop and reflect on current password hygiene every year. Passwords remain one of the biggest cyber challenges for consumers and businesses worldwide. A poor password choice can make it extremely easy for cybercriminals to steal and spy on your data.

As humans, we continually gravitate towards creating passwords that are easy to remember and simplistic. Incorporating a birthday or special date within a password is a common denominator that cybercriminals are all too aware of.

Dangerously, we continue to leave it up to humans to create strong and secure passwords, even though most people have already been victims of borderline password disclosures from their history of password choices. Having already had your previous password decisions and choices exposed means that an attacker can simply take that as the baseline and create variations.

An effective password should include passphrases and a sequence of random words for added security. Regular consumers should consider deploying and utilising a password manager to enhance and regularly rotate their log-in credentials.

For organisations, a password manager should be a default implementation. If you are a business leader, you must move beyond just having password managers to control and protect privileged access. Privileged access security will help automate, rotate and secure passwords for you and your business, eliminating a significant amount of cyber fatigue.

Taking it a step further, organisations should look beyond just their internal password hygiene and take a deeper dive into their suppliers and contractors to ensure password protection. Are they using a password manager, do they have MFA deployed, and how do they protect access to their privileged accounts? We've seen the catastrophic domino effect that one poor password choice can have within a supply chain.

Organisations can enhance their password posture by understanding that security starts with your social network. Why not encourage your employees' families to use a password manager and reward them? They see that you're not just taking care of the company but extending security to the social sphere so that their family and kids can use password managers and reduce the threats.

Attackers can and will target family first as stepping stones to get into your organisation. So it makes you think, why not extend your perimeter to the social sphere around the organisation? Your supplier, your contractor, partners, your customers and everybody.

Just remember one thing, though: no matter how much time, money and effort you spend on your defence mechanisms and protecting your perimeter, you can be exposed from within if your technology and systems are old, outdated or left unpatched. This is the hard lesson WannaCry taught us five years ago.

WannaCry, five years on

The May 2017 WannaCry ransomware attack sent shockwaves globally, impacting hundreds of thousands of computers and devices and leaving billions in damages. Little did we know then that it was just the start of a rise in more sophisticated, widespread and detrimental ransomware attacks. Since then, we have seen a steady stream of high-profile ransomware victims and a rise in the number of ransomware groups offering ransomware-as-a-service (RaaS).

As we look towards the future, there are several initiatives organisations can implement to limit their exposure to such threats. One is segmentation, essentially using technical guardrails that separate one business function from another. This minimises the unchallenged propagation of malicious actors and malware.

Another best practice is to identify all critical assets that are most commonly targeted for attacks and perform frequent incremental backup if a system recovery is needed. Strong multi-factor authentication and privileged access controls are also obvious components.

Every user is now a privileged user with access to sensitive systems and data. Organisations should consider a least privilege approach to access, limited to only what is required for the job function or task. While it will not help increase operational readiness, organisations should also always be prepared for the worst-case scenarios with a cyber insurance plan to cover any losses.

Ransomware attacks continue to proliferate today. While government agencies worldwide work to implement measures to prevent ransomware attacks and prosecute those who partake in such activities, successfully mitigating ransomware attacks requires a host of combined initiatives.

This includes implementing security controls founded in least privilege and Zero Trust, the creation of a security-first company culture and employee training, robust threat detection and response, collaboration between public and private sectors, and most importantly, operating on the mindset that it is not 'if' cybercriminals will attack but when.