An account takeover traditionally follows a methodical path that takes considerable time before anything bad happens. Is it worth a company’s time and effort to be monitoring a potential account takeover at the earliest stages?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series and Allan Alford (@AllanAlfordinTX). Our sponsored guest is Mike Wilson, CTO and co-founder, Enzoic.
Got feedback? Join the conversation on LinkedIn.
Thanks to this week’s podcast sponsor, Enzoic
On this episode of Defense in Depth, you’ll learn:
- Attack takeover (ATO) has a life cycle with multiple (6) steps. The first step is reconnaissance and you need to focus on that to stop the life cycle.
- There’s plenty of talk about sharing OSINT (open source intelligence), but the reality is, and always been, that there are more consumers than contributors. Like any open source endeavor, it can only get better if more people contribute.
- Account takeover has at its root in stolen credentials, and as we know from sites like “Have I been pwned?” there are billions of stolen credentials floating out there that are consistently being used in credential stuffing attacks.
- What is your credential situation? How unique are they? Can they be learned?
- Start threat modeling your existing systems to determine what type of investment you’ll need to make in account takeover.
- You can greatly reduce the risk of ATO by implementing multi-factor authentication (MFA) and privileged access management (PAM).
- The bad guys are playing the same game as we are and we essentially need to have better reconnaissance than them. Problem is they’re sharing information freely and we’re not.