How to eliminate your organization’s exposure to compromise after the LastPass breach
It’s crucial to consider the benefits and risks
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
LastPassis a widely used password manager relied on by 100,000 businesses and 33 million individuals to secure their passwords. Whilepassword managersoffer convenience, they also come with security risks and it’s crucial to carefully consider the benefits and risks before adopting them in an organization. Poor password policies, lack of control, or even a single user error can result in disastrous consequences. However, in some cases, the very thing people fear most can occur – the password manager itself can be compromised.
The recentLastPass data breachis a cause for huge concern for organizations and individuals who have utilized this password manager. On December 22nd, LastPass revealed that a security incident that they had previously reported on November 30th was actually a massive data breach. The attackers are believed to have used information obtained from an August attack on the company to carry out another attack in November.
Unfortunately, it’s not the first time this has happened; on June 15, 2015, LastPass announced that its network had been breached, compromising data such as email addresses, password reminders, and password hashes.
The most recent breach allowed an unauthorized party to access sensitive user account information, including personal information such as usernames, email addresses, phone numbers, names, billing addresses, andIP addresses. Additionally, the breach exposed stored website URLs, which could be used to launch phishing attacks, and stole vault data, including usernames, passwords, secure notes, and form-filled fields. Although this data remains encrypted, if an attacker cracks the master password, they would be able to access all the information stored in the vault. Changing the master password now would not solve the issue, as hackers have a copy of the vault.
Mike Walters, VP of Vulnerability and Threat Research at Action1.
For businesses that requireemployeesto use LastPass as part of their official password policy, the risk is obvious. If an attacker cracks or steals an employee’s LastPass master password, they will have unrestricted access to the company’s most sensitive data.
Overall, this breach highlights several related issues that, when combined, can cause devastating consequences:
This puts both personal and corporate-managed users at risk, as the breach demonstrates the vulnerability of even well-established password managers.
What can we do now?
To mitigate the risk posed by the LastPass breach, all users are advised to reset their passwords site-by-site, as simply changing the master password now would not solve the issue. They should also follow best practices for passwords and enable multi-factor authentication (MFA) where possible.
For sysadmins, the following recommendations should be considered:
Conclusion
The LastPass data breach is significant in several ways. First, it serves as a valuable reminder for all of us to rethink password security practices. Second, it shows that even if an attacker initially gains access to a non-sensitive aspect of a company’s infrastructure, they can still exploit security vulnerabilities and obtain sensitive customer data that resides in a different but interconnected environment over time. This reminds organizations on the importance of thoroughly examining security weaknesses if a successful attack occurs, in order to prevent future hacks, including taking prompt action to investigate any security incidents and identifying and remediating any security vulnerabilities.
We’ve ranked the best business password managers.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Mike Walters, VP of Vulnerability and Threat Research at Action1.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
