This devastating blow to an organization can radically change the course of business or, worse, result in insolvency.
Eight million dollars.
That’s the average cost of a data breach in the U.S. today, according to IBM. This amount continues to increase with the plethora of ransomware attacks. This trend has been fueled by distributed remote work and hybrid work arrangements, which have become more common among organizations worldwide. Because residential internet service providers (ISPs) often lack critical, enterprise-grade encryption, these distributed, remote workforces are often a catalyst for an organization’s vulnerability to a massive cyberattack.
The overwhelming majority of data breaches are caused by compromised login credentials. Once a breach occurs, it takes an average of 250 hours for security personnel to detect it – and even longer to contain it. In the interim, cybercriminals remain inside the organization’s network, exfiltrating data, planting malware and causing damage that can cost millions of dollars to mitigate.
Let’s examine some of the most common causes of data breaches, along with ways to prevent them, courtesy of Keeper Security, the creators of the leading cybersecurity software for preventing password-related data breaches and cyberthreats.
Common causes of data breaches
Unpatched software
All software has vulnerabilities that can be exploited, particularly if patches are not kept up to date. In 2017, cybercriminals exfiltrated hundreds of millions of customer records from credit reporting agency Equifax because the organization had been running an unpatched version of Apache Struts.
It’s critical for organizations to ensure that all of their software is kept updated. Because the cyberthreat environment is continuously in flux, developers release regular updates that contain important security patches addressing new and emerging threats.
Malware
Malicious software poses a constant threat to anyone who uses the internet, whether it’s delivered through visiting suspicious websites or opening email attachments from unknown senders. Worse yet, cybercriminals have evolved beyond targeting individual users or computers to target enterprise systems. Once a malicious app has breached an organization’s system, the damage it can do is devastating, ranging from exfiltrating highly sensitive information to corrupting hard drives or backups.
Most businesses use firewalls and basic security protocols to prevent malware from taking hold in their networks, but employee education is key. Employees need to be trained how to recognize phishing emails and phony, look-alike websites.
Physical attacks
Physical security plays a major role in cybersecurity. If cybercriminals can enter and wander through an office without anyone questioning them, they can take hardware like computers, hard drives, flash drives, phones or even an entire server.
A security team and restricted access points that require a keycard or other authorization to enter go a long way toward discouraging physical attacks.
User error
Even the most diligent employee can make a mistake and fall for a phishing scam, use a weak password or incorrectly configure a cloud server. Basic employee training and clear, comprehensive security rules go a long way toward preventing security incidents. With cooperation between the IT team and non-technical employees, compliance with internal security protocols and regular security training, any organization can practice basic security measures.
Password vulnerabilities
The media portrays cybercriminals as hooded figures furiously tapping away on their keyboards, spinning up code that lets them brute-force their way into enterprise networks. The reality is far less dramatic. The overwhelming majority of data breaches happen because of weak or stolen passwords.
When an employee uses an easy-to-guess or common password, such as their name, birthday or “Password1!,” cybercriminals can easily bypass millions of dollars’ worth of security defenses and essentially walk right through the front door of an organization’s network.
Even when employees use secure passwords consisting of random strings of characters, many write their credentials on sticky notes and leave them in plain view. If someone can simply glance over the employee’s shoulder and see what their password is – and, yes, cybercriminals do this – it defeats the purpose of having one in the first place.
According to Keeper Security’s “Workplace Password Malpractice Report 2021,” up to 62% of an organization’s employees engage in insecure password practices. Here are some highlights from Keeper’s report:
- Fifty-seven percent of employees keep a password on a sticky note in their workspace, while around half keep passwords saved in an unencrypted file on their phone, their work computer or a cloud folder.
- Up to 44% of employees use weak passwords that include personal information such as family names or birthdays, or they’re reusing passwords from personal accounts that may already be compromised.
Improving password security
One of the biggest stumbling blocks to password security is that humans simply can’t remember multiple unique, complex passwords. That’s why the most common passwords are so easy to guess – they’re easy to remember. However, in the last few years, password-management solutions have emerged, helping users create complex, unique passwords and storing them securely, for easy access whenever the user needs them.
In addition to giving users an encrypted digital vault to store and organize their passwords, password managers automatically generate complex, unique passwords for users and automatically fill them on websites and apps. With an enterprise-grade password management solution like Keeper Security, organizations can enhance their security while also improving employee efficiency.
Enterprise password-management systems also help protect employees from entering their credentials on phishing sites, and they provide IT admins with visibility into employee password practices and the ability to ensure that users are complying with internal password security rules. For more information about enterprise password management platforms or to sign up for a free trial, visit KeeperSecurity.com today.
