Passwords and Missed Patches: The Two Weak Points Behind Most Data Breaches

When staff can work from anywhere, keeping an organisation compliant with security policy becomes hard. Michael Waring, vice president for Asia Pacific and Japan in Ivanti's Security Solutions Group (SSG), notes that many employees do not follow the same rules at home that they would in the office. They may browse sites they would avoid at work, or use a device that is not fully reliable or secure enough to handle company data.

Criminal activity aimed specifically at people working from home has grown since the pandemic began. Cybercrime rose 19.1 per cent in 2020 over the year before. INTERPOL's ASEAN Cyberthreat Assessment 2021 found that the main pandemic-related attacks were phishing, scams and fraud (59 per cent), malware and ransomware (36 per cent), malicious domains (22 per cent) and fake news (14 per cent).

The methods attackers use, however, are the same as before, and passwords remain the top cause of data breaches. Verizon's 2020 Data Breach Investigation Report attributes 81 per cent of hacking-related breaches to compromised passwords. Patching still leaves gaps too: recent research traced almost 60 per cent of breaches over the past two years to missing operating system or application patches.

Routine chores such as installing patches and resetting passwords keep piling onto IT teams. Waring argues that both problems must be tackled, to lighten that daily load and to build a zero-trust environment in which each user gets verified access only to the company resources they need.

Why passwords keep failing

In Waring's view, credentials and passwords are a critical weakness in security infrastructure. Nobody can remember 50 complex passwords, so the first thing users do is cut down how many they use. Employees therefore often reuse the same credentials for personal and work accounts, and a quarter (25 per cent) admit logging in to consumer websites with their work email address and password.

When someone's Amazon account is hacked, for example, the login details have usually been lifted from a smaller commerce site with weaker protection. If the same credentials also open business applications, that employee may be exposing the whole organisation. Criminals understand this behaviour well and use it to break into other accounts; credential stuffing as an attack method depends entirely on password reuse.

Replacing passwords with context

Waring recommends that companies move away from weak, easily forgotten usernames and passwords towards more secure technology using biometrics such as facial recognition. That takes away the burden on employees of creating and remembering strong passwords, and it makes life easier for users as well by enabling single sign-on.

Removing passwords should go hand in hand with the ability to relate the user to the data being accessed. Granting access simply because the right username and password were typed is inadequate, he says. IT teams should be able to check contextual attributes: where the employee is connecting from, what kind of device they are using and whether it has been compromised, which network they are on and whether it is secure, and the time and location of the request. A login from London followed immediately by an attempt from New York or Singapore, for instance, should trigger an alert. Zero trust, Waring writes, can only be established by continually examining key security attributes gathered from the user and the device.

The race to patch

Collecting information on patches is laborious. Some vendors, Adobe and Microsoft among them, publish patch information on the same day each month, known as Patch Tuesday. Others release it whenever a problem comes up. The average enterprise runs 464 applications, and gathering patch details for each one from news reports, specialist forums and blogs, then checking them regularly for updates, takes an enormous amount of time.

Once a patch is released, defenders are racing to apply it before the flaw is exploited, and attackers frequently move faster. Remote working has made patching more urgent because the devices that reach company data now sit outside the corporate perimeter. Companies typically take 100 to 120 days to deploy a patch after it becomes available, which hands attackers three to four months to exploit the vulnerability.

Patches can also be reverse engineered to work out how to exploit the flaw they fix. The pressure is greater still when a patch closes a vulnerability that was already known or being exploited: attackers realise their exploit will soon stop working and try to use it as fast as they can.

Automation as the answer

For companies trying to keep productivity high and disruption low while coping with remote work and rising risk, Waring suggests hyper-automation, which he calls key to a zero-trust environment. Replacing manual tasks with AI and ML reduces complexity, improves accuracy and frees staff for more important work. Automation takes over the constant assessment of the relationship between employee, device, network and application, and it can run the patching process too.

Automated patch management tools let IT teams watch in real time what is going to be patched as updates are collected from many online sources. When patch management and privilege management are combined in a single product, devices and applications outside the company network can be patched through a cloud component, keeping IT in control of the process.

A configured patch campaign then repeats every month. If it is set to start two days after Patch Tuesday, for example, the automation collects every patch up to that date, and further campaigns can be added to cover all applications. Tying patch management into a unified endpoint management (UEM) platform also lets organisations control which applications are downloaded, cutting down shadow IT, and helps keep applications on every company device regularly patched wherever employees are working.

Security, Waring observes, has trailed behind the fast digital transformation of the past year, and criminals have kept exploiting weak credentials and unpatched systems to reach business data. He sees hyper-automation and single sign-on as major steps towards removing both problems and building a zero-trust environment, and with working from anywhere here to stay, he argues that patch and access management need upgrading now.