Is Your “Secure” Password Policy Actually Secur
Is Your “Secure” Password Policy Actually Secure, read on to know.
While more and more of our private communication, health records and financial transactions are stored online, a strong password policy is our front line of defence to protect information. This kind of information, if in the wrong hands, can pose serious security risks and it’s more important now than ever for administrators to enforce a strong password policy.
23.2 million people were hacked worldwide who used the password: “123456”. This reiterates the fact that not only do users need to come up with stronger passwords, but administrators must also educate users in how to make these strong passwords. Here’s how to go about it.
Understand What A Secure Password Policy Is
A password policy is a set of rules that guides users to create strong and dependable passwords that will help improve computer security. While some password policies are simply guidelines that a user has to follow and not abide by, other times the user must adhere to the strict requirements of the password policy.
While most people are aware of the security risks of keeping a simple password, it can be troublesome for them if the password policies are extremely strict and unfamiliar. Most users get frustrated keeping up with the regulations that they create a password that just barely meets the requirements.
Enforce Using A Strong Password
The stronger the password, the higher the level of security you have. There are certain rules a password policy must have in order to generate strong passwords. While these rules are not set in stone, they are good in providing direction for the users to create strong passwords that can’t be easily hacked.
The kind of rules that every strong password policy must have include: a decent length, minimum of 8 characters long. No personal information at all, and it should be unique from your previous passwords. It should also include uppercase and lowercase letters, numbers and symbols.
Pass-Phrase Instead of Pass-word
Instead of using a password, users can implement the use of a pass-phrase. With growth in computing power and technology, cracking a word, even if it’s littered with numbers and symbols is not that difficult for a computer than can run 300,000 possible password variations in a second.
A pass-phrase however, something like “I-am-going-to-church-on-Sunday”, would have over one sextillion possible variations. Even a computer running 300,000 possible variations per second would require years to crack the pass-phrase. Pass-phrases are longer and much harder to guess even for computers and are even easy to remember for the average person.
Having trouble forming a “secure” password policy? Well, let us at Lean Security provide you with the assistance you need! Protect your vital information from hackers and scammers by indulging in our penetration testing services.
We also cover mobile application penetration tests to ensure that the safety of your information is guaranteed! Contact us today for more details.
Me Confused: What’s the Difference Between Vulnerability Assessment and Pen Testing
Vulnerability assessment and pen testing are very different from each other, read how:
We hear you; vulnerability assessment and pen testing sound erringly similar. To be honest, the two security assessment methodologies even confuse established vendors and experienced cybersecurity professionals. But the fact is vulnerability assessment and pen testing are very different from each other, and today in this post, we’ll be explaining this difference.
The Difference Between Vulnerability Assessment and Pen Testing
Vulnerability assessment is testing a system, network, app or other computing resource for “known” vulnerabilities and finding out which vulnerabilities apply to the resource.
You might ask:
What are known vulnerabilities?
Known vulnerabilities are those vulnerabilities that are already out there in the domain of public knowledge. They might be listed in the National Vulnerability Database (NVD), reported on the internet, stored in open databases, or available on the dark web.
So during vulnerability assessment, your testing team will basically have a list of known vulnerabilities, and they’ll check your system for each of them to find out if they apply to your case.
Vulnerability assessment is conducted using automated scanning tools.
Pen testing, on the other hand, involves testing a system, network, app or other computing resource for both known and unknown vulnerabilities and exploiting those vulnerabilities to evaluate the severity of the risk at hand.
During pen testing, the testing team executes a simulated attack on your resource that mimics the strategies and actions of hackers.
It must be mentioned here that vulnerabilities that don’t lead to anywhere valuable are typically ignored in a pen test.
So, for example, let’s say you have a landing page that has minimal user engagement. A pen test would not focus on that page because the testers would know that the page is of little value. In contrast a vulnerability assessment would treat that page with equal significance as any high converting landing page.
Pen testing is conducted using both automated tools and manual penetration.
To summarize the difference between vulnerability and pen testing:
A vulnerability assessment helps you identify if the doors in your office building are unlocked. A pen test helps you identify which doors in your office building are unlocked and what criminals would do once they are inside your office building.
We hope now you are clear about the difference between vulnerability assessment and pen testing.
For further reading: 3 Major Pen Testing Techniques
A Business Owner’s Basic Guide to Pen Testing
Pen testing, short for penetration testing, has never been more important than it is today. Here’s a basic guide for you;
Pen testing, short for penetration testing, has never been more important than it is today. With ransomware, phishing, DDoS attacks and countless other tactics used by increasingly sophisticated cybercriminals, the best defence starts with knowing your strengths and weaknesses.
What is pen testing?
Pen testing is the practice of evaluating a system’s security infrastructure to find potential vulnerabilities and understand how the system could be attacked. This information is then used to suggest countermeasures that can be taken to reduce the risk of security breaches and improve security maturity.
Pen testing is conducted by hiring cybersecurity professionals. The security professionals are authorized by the company to conduct a simulated attack on its behalf to test its computer system, network, software application or other computing resource for potential loopholes.
Since the goal of a pen test is to help the company strengthen its security infrastructure, and the findings of the test are strictly used for that purpose and that purpose only, pen testers are also commonly referred to as ethical or white hat hackers.
The pen testing process
A typical pen testing process involves five steps:
· In the first step, pen testers gather information about the computing resource that needs to be tested. This information is gathered by using different tools.
· In the second step, the gathered information is studied by the testing team to identify potential vulnerabilities in the system.
· In the third step, an attack is designed to exploit the identified vulnerabilities.
· In the fourth step, the testing team evaluates the significance of the data at risk and prioritizes the vulnerabilities accordingly.
· In the fifth and last step, pen testers report on their findings and recommend ways on how the vulnerabilities can be eliminated.
Wrapping up
Sun Tzu wrote in the Art of War: “If you’re ignorant of your enemy and yourself, you’re certain to be in peril.”
Pen testing offers intelligence on how your enemy (a potential attacker) might exploit your system resources and provides insight into your strengths and weaknesses, so that you can better prepare against future cyber attacks.
Looking for a comprehensive pen testing service for your business?
Lean Security can help.
We are expert pen testers, headquartered in the beautiful state of New South Wales. We specialize in mobile application pen tests, web application pen tests, web service pen tests, IoT pen tests, external network pen tests and source code pen tests. Contact us today to discuss your pen testing needs.
Bots, Bots Everywhere: 5 Largest DDoS Attacks in the History of the Internet
We know how a DDoS attacks can overwhelm a system’s resources and take it down to the ground.
We know how a DDoS attacks can overwhelm a system’s resources and take it down to the ground.
But sometimes DDoS attacks can scale beyond our wildest imaginations. We’re talking about attacks that clock bandwidths in tera and giga bite ranges and notoriously leave their marks in history books.
Spamhaus
Spamhaus is a non-profit anti-spam organization based in London and Geneva.
In 2013, Spamhaus website, email servers and DNS IPs were taken down by a DDoS attack that measured in at 300 gigabits per second.
Investigations traced the attack to a member of Dutch company named Cyberbunker.
CloudFlare
CloudFlare is a content delivery network (CDN) and security service provider headquartered in San Francisco.
In 2014, CloudFlare’s network was slammed by a DDoS attack that peaked at more than 400 gigabits per second.
The attack was originally directed at a CloudFlare customer, but it was so powerful that it brought down the company’s entire network to its knees.
The perpetrators leveraged the NTP servers to launch the attack.
Occupy Central Movement
Occupy Central was a Hong Kong civil disobedience campaign initiated by Benny Tai, Reverend Chu Yiu-ming and Dr. Chan Kin-man in 2013, advocating for a democratic electoral system.
Unimpressed by the movement, attackers sent large amount of traffic to Occupy Central’s webhosting services, causing the servers to crash.
The DDoS attack recruited five botnets and measured in at 500 gigabits per second.
2) Dyn
Dyn, Inc. is an internet performance management and web application security company based in the U.S.
In 2016, Dyn was targeted by a series of DDoS attacks which spiked up to 1.2 terabits per second. The attacks used mirai-infected IoT-enabled devices to bombard the company’s servers.
The SpainSquad, New World Hackers and Anonymous claimed the responsibility for the attacks.
GitHub
GitHub is a code hosting platform for collaboration and version control.
On February 28, 2018, GitHub was taken down by a DDoS attack that clocked in at a whopping 1.35 terabits per second.
Interestingly, the attack did not use any botnet network, and instead relied on misconfigured Memcached servers for amplification.
The attack remains the largest DDoS attack ever recorded in the history of the internet.
Is your business protected against potential DDoS attacks? Don’t be vulnerable; call our cybersecurity experts today and make sure you’re covered from any and all threats.
Introduction to Penetration Testing
Cyber attacks are becoming increasingly common. There, it has become necessary to keep networks secure.
