February 7th, 2013
As the sophistication of malware evolves and organizations face an increasingly tumultuous threat landscape, heavy investments are continually made for new security controls, policies and best practices. Yet, one critical – but avoidable – flaw remains. The human aspect of IT practice is a key weakness for most organizations, and the vast majority of today’s breaches continue to stem from internal end-user error, rather than external attacks In fact, among 308 security breaches examined in the latest Information Security Trends study by CompTIA, 54 percent were caused by human error, and nearly half of those errors were attributed to end-users’ failure to follow company security policies.
- December 14th, 2012
A recent whitepaper published by Microsoft describes an attack known as Pass-the-Hash (PtH), which has become a common attack vector for credential theft. A PtH attack is where an attacker captures account logon credentials, but instead of capturing the clear text password, the attacker captures the password hash, which can then be re-used to logon to network services, because the password hash is an unsalted MD4 hash.
I’m not going to go into too much depth in this post, as the whitepaper provides comprehensive information on these attacks, which I highly recommend you read – Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques