Who's that knocking at the door? The problem of credential abuse. Issue 2 (February 2021)

• Record Type: Journal Article
• Authors: Mansfield-Devine, Steve
• Is Part Of: Network security. Volume 2021:Issue 2(2021)
• Page Start: 6
• Page End: 15
• Publication Date: 2021-02
• Subjects: Computer security -- Periodicals; Computer networks -- Security measures -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; Computers -- Access control -- Periodicals; 005.805
• DOI: 10.1016/S1353-4858(21)00018-0
• Languages: English
• ISSNs: 1353-4858

Abstract

Abstract : At the heart of IT security is a simple concept – proving you are who you say you are. In this context, 'you' might be a human logging into a network or service, a device interacting with an application programming interface (API), one network talking to another or any number of other scenarios. And the proof could be a certificate, an SSH key, a token of some form or our old favourite – and inevitably the artefact we'll be talking most about here – the old, fragile and yet seemingly unkillable password. At the heart of IT security is a simple concept – proving that you are who you say you are. But the ways we have of doing that, through credentials of some form, are flawed. Credential abuse comes in many forms. The question we need to ask is, where does it sit in terms of an organisation's attack surface and security priorities? In the first of a two-part feature, Steve Mansfield-Devine surveys a number of industry experts to get their views on what forms of credential abuse are being encountered and the threat these pose to enterprises.