Fifty percent of employees use the same password for work and personal accounts. Why is this concerning? Because a new(ish) hacker trend known as “password dumping” or “credential dumping” means those repetitive passwords make your network more vulnerable to attack.

WIRED defines credential dumping like this:

In many modern hacking operations, the difference comes down to a technique known as “credential dumping.” The term refers to any means of extracting, or “dumping,” user authentication credentials like usernames and passwords from a victim computer, so that they can be used to reenter that computer at will and reach other computers on the network. Often credential dumping pulls multiple passwords from a single machine, each of which can offer the hacker access to other computers on the network, which in turn contain their own passwords ready to be extracted, turning a single foothold into a branching series of connected intrusions. And that’s made the technique at least as crucial to hackers’ work—and as dangerous for sensitive networks—as whatever phishing email or infected attachment let hackers find entry into the network in the first place.

Credential dumping is largely possible because operating systems have long tried to spare users the inconvenience of repeatedly entering their password. Instead, after a user is prompted to enter it once, their password is stored in memory, where it can be called up by the operating system to seamlessly prove the user’s identity to other services on the network.

The bad guys have figured out it is much easier to hack your network with stolen user credentials than it is to penetrate your multi-layered security software system. And, when users reuse the same passwords across accounts, your risk to falling victim to a data breach is greater. 

Find out now if browser-saved passwords are putting your organization at risk.

Our partner KnowBe4 has a free tool called the Browser Password Inspector (BPI), which allows you to analyze your organization’s risk associated with weak, reused, and old passwords that your users save in Chrome, Firefox and Edge web browsers.

BPI checks the passwords found in the browser against active user accounts in your Active Directory. It also uses publicly available password databases to identify weak password threats and reports on affected accounts so that you can take action immediately.

With Browser Password Inspector you can:

• Search and identify any of your users that have browser-saved passwords across multiple machines and whether the same passwords are being used
• Quickly isolate password security vulnerabilities in the browser and easily identify weak or high-risk passwords being used to access your organization’s key business systems
• Better manage and strengthen your organization’s password hygiene policies and security awareness training efforts

Get your results in a few minutes. Then, using these results, convince your managers that it’s time to provide security awareness training to your users!

Would you like to try this free tool? Click here. Or contact me today and I’ll send you a personalized URL. 303-800-5408, Doug@SavvyTraining.com