Recommended
Recommended
More Related Content
What's hot
What's hot (16)
Similar to After the Data Breach: Stolen Credentials
Similar to After the Data Breach: Stolen Credentials (20)
More from SBWebinars
More from SBWebinars (20)
Recently uploaded
Recently uploaded (20)
After the Data Breach: Stolen Credentials
- 1. After the Data Breach: Stolen Credentials March 7, 2018
- 2. Agenda Credentials Knowledge Base! ● NIST Password Guidelines Overview ● Implementing NIST Guidelines with Blackfish ● Q&A Justin Richer Coauthor of NIST Digital Identity Guidelines Gautam Agrawal Product Management @ Shape Security
- 3. @justin__richerhttps://bspk.io/ NIST Password Guidelines Justin Richer Bespoke Engineering 3
- 18. @justin__richerhttps://bspk.io/ At least 6 characters 18
- 20. @justin__richerhttps://bspk.io/ Upper and lower case 20
- 26. @justin__richerhttps://bspk.io/ Entry Entropy (bits) word 12.1 password 28.7 Password 34.8 Pa$$w0rd 36.0 p@ssW0rd! 42.9 P@ssword1 41.9 26
- 28. @justin__richerhttps://bspk.io/ These are all terrible passwords 28
- 31. @justin__richerhttps://bspk.io/ Everybody applies the rules differently 31
- 32. @justin__richerhttps://bspk.io/ Upper limits on length 32
- 41. @justin__richerhttps://bspk.io/ Difficult in mobile applications 41
- 42. @justin__richerhttps://bspk.io/ We thought we were fighting: 42
- 45. @justin__richerhttps://bspk.io/ What we’re actually fighting: 45
- 52. @justin__richerhttps://bspk.io/ We should do better 52
- 55. @justin__richerhttps://bspk.io/ Less reliance on passwords 55
- 57. @justin__richerhttps://bspk.io/ Allow whitespace and unicode 57
- 58. @justin__richerhttps://bspk.io/ No upper limit on size 58
- 59. @justin__richerhttps://bspk.io/ correct horse battery staple! 59
- 60. @justin__richerhttps://bspk.io/ Entry Entropy (bits) word 12.1 password 28.7 Password 34.8 Pa$$w0rd 36 p@ssW0rd! 42.9 P@ssword1 41.9 correct horse battery staple 104.2 60
- 62. @justin__richerhttps://bspk.io/ Still have minimum lengths 62
- 63. @justin__richerhttps://bspk.io/ ✅ 🐎 🔋 🖇! 63
- 65. @justin__richerhttps://bspk.io/ Hashed and salted storage 65
- 66. @justin__richerhttps://bspk.io/ Check against a blacklist 66
- 69. @justin__richerhttps://bspk.io/ When do you check it? 69
- 70. @justin__richerhttps://bspk.io/ How do you check it? 70
- 72. @justin__richerhttps://bspk.io/ Where do you get your blacklist? 72
- 76. @justin__richerhttps://bspk.io/ Where do you download it? 76
- 78. @justin__richerhttps://bspk.io/ How do you trust that service? 78
- 80. Implementing NIST Guidelines with Blackfish Gautam Agrawal
- 81. Where do you begin? Password Blacklists
- 82. When Do You Generate The Blacklist? 2013 Yahoo Breach Credential Stuffing starts Breach Discovered 2016 Some credentials may be on Darknet Typical Blacklist generation e.g. Darknet research firms Blacklist generation should start here Stolen credentials not available on Darknet
- 83. Stolen Passwords Detected Breaches Passwords on Dark Web Ideal Blacklist Universe of Passwords ~90 Billion (expected to grow to 300 Billion by 2020) What Should The Blacklist Have? Typical Blacklist
- 85. Go where stolen credentials are used first Typical Blacklist… too little, too late.
- 86. Introducing Blackfish 2013 Yahoo Breach Credential Stuffing starts Breach Discovered 2016 Some credentials may be on Darknet Typical Blacklist generation e.g. Darknet research firms Blackfish starts list generation here Stolen credentials not available on Darknet
- 87. How Blackfish Works Blackfish Knowledge Base Credentials Knowledge Base!Captures credentials used in Credential Stuffing attacks Checks and informs if stolen passwords are being used
- 88. Largest banks Largest federal agencies Largest online services Largest hotel chains Largest airlines Largest retailers Why Blackfish Stolen credentials are used against the largest targets
- 89. Why Blackfish Shape protects largest enterprises that are attacked first Shape customer network sharing & deactivating compromised credentials 3 of the top 5 airlines 3 of the top 4 banks 5 of the top 10 retailers 1 of the top 5 online services2 of the top 3 government agencies 3 of the top 5 hotels
- 90. Why Blackfish Credentials Knowledge Base! Shape detects and mitigates credential stuffing attacks at scale: • 500M transactions/day • 100M logins/day
- 91. Most Comprehensive Blacklist (Breach Corpus) Best Enterprise Network + Best Detection Ability =
- 92. Blackfish Security Credentials Knowledge Base! ● Blackfish knowledge base uses Bloom filter to transform credentials into a binary representation ● No need to store hashed or clear text credentials ● Can’t be brute forced the way hash tables can Blackfish Knowledge Base
- 93. Blackfish Capabilities Credentials Knowledge Base! ● Access to the most comprehensive Blacklist ● Simple API integration, directly within your web/mobile apps ● Checks for use of stolen passwords during ‘Account Create’ and ‘Password Reset’ ● Checks for use of stolen passwords during ‘Login’ ● Monitors enterprise domains or individual users to identify if their credentials are breached
- 94. Blackfish Outcomes Credentials Knowledge Base! Long Term ● Stolen credentials become less valuable to attackers ● Credential Stuffing attacks and fraud are reduced Short Term ● Organizations proactively defend themselves from attacks ● Reduced operational risk to the organization
- 95. Blackfish auto-creates the right corpus Don’t rely on the dark web