Monitoring account logins to organizational servers and workstations, is just like locking your front door, it is critical for detecting password or cracking attempts. Attackers are motivated by the desire to acquire access to sensitive data and systems, or to use that access to pivot to other valuable targets, such as supply chain partners. According to the 2019 Verizon Data Breach Investigation Report , compromised or weak credentials are involved in 80% of hacking-related incidents (DBIR).
Background of the Attack
Login attacks occur when hackers steal login credentials from a legitimate user, such as a system administrator (sysadmin), to obtain access to vital systems and steal sensitive data, or for corporate espionage. Because of their limited IT staff and knowledge, small and mid-sized businesses (SMBs) might become the path of least resistance for hackers. There are three sorts of authentication threats to keep an eye out for:
Brute force assault: An offensive approach that depends on repetitive trial and error attempts to guess probable combinations of a targeted password, passphrase, or PIN.
Dictionary attack: A cybersecurity attack that uses an automated wordlist to find passwords using words from a dictionary.
Low and slow authentication attack: A slow authentication attack that uses known factors such as the name of an administrator’s spouse or child to guess the password and evade discovery and lockout.
It’s critical to understand these types of attacks so you can spot malicious activity on your network. Compromising privileged accounts to get access to data center systems or pivot to databases that can be monetized, such as credit cards or gift card inventory, is the ultimate login target for hackers.
Anomalous Login Attacks’ Consequences
Credential-based assaults have both direct and indirect consequences, particularly when they result in data loss and a public data breach. Impacts on organizations and customers may have far-reaching consequences that extend far beyond a security breach. Customers or supply chain partners may lose faith in you and defect to one of your competitors.
Costs incurred directly
Lost revenue, the cost of refunds or providing new credit cards, credit card monitoring charges, customer contact costs, and related legal fees are all examples of “hard” or direct costs linked with account takeover. It also includes costs associated with cleanup, such as the employment of a forensic investigator or the purchase of new technology.
Indirect Expenses
The “soft” expenses, also known as indirect costs, are just as concerning as the direct costs. The time and effort required resetting logins, the lost productivity involved with internal investigation and remediation, and the loss of brand reputation, as well as customer churn, are all indirect costs connected with a data leak or true breach. The ultimate price is a loss of customer trust and reputation, which can have a negative impact on your company’s success and even survival.
Conclusion
Increase your security activities to improve visibility and defenses over time. Stealthy cyber criminals focused on getting the “keys to your kingdom” to access VIP accounts in order to pivot to other sensitive data are discovered through anomalous login detection.
