Compromised Credentials

Compromised credentials still account for a number of incidents, underscoring the need for more organizations to adopt MFA and implement dark web monitoring, according to Tetra Defense.

In some instances, these incidents are from threat actors brute-force attacking systems username and password combinations. But in many of these cases, password reuse is to blame from employees using the same username and password across multiple sites. If one of the sites experiences a breach and the credentials are leaked to the dark web, those credentials can be used to compromise other systems where the same pair of username and password is used.

With MFA in place, exploitation of compromised credentials becomes more challenging because even if a threat actor has a known username and password pair, the account remains inaccessible without a second factor of authentication such as an app push notification, text message or security challenge question.