Why password spraying is still an effective attack method

Password spraying, a type of brute-force attack where a password is used across a large list of accounts, is still one of the most effective ways malicious actors around the world gain access to organizations' systems.

Earlier this year, Check Point Research uncovered an Iranian-backed password spraying campaign that targeted the Microsoft 365 accounts of over 300 organizations. The hackers used Tor exit nodes, VPNs, and weak credentials to access sensitive emails and data.

How does password spraying get past identity-based security? And what should IT leaders do about it?

On this week's episode, Bobby and Ross speak to Chris Skipworth, the CEO of Passpack, to find out why password spraying is so often a successful attack method, and what approach IT leaders should take.

Highlight

"If a solution isn't easy to use, they're not going to use it; they're going to go around it.

"Fundamentally, everyone has to own security within an organization. If there is a breach, it can affect the organization financially, especially if it's a small business. So it pays for people to be aware of what they're doing with their credentials."

Links

• The rise of identity-based cyber attacks and how to mitigate them
• Hackers are on a huge Microsoft 365 password spraying spree
• The Iran cyber threat: Breaking down attack tactics