Most Breaches Start With a Stolen Password

Most breaches I've seen start with a stolen password. Not a zero-day. Not a nation-state. A password that was reused, phished, or guessed.

That's good news, because the fix is known, affordable, and mostly a matter of discipline.

Three things worth doing this quarter

1. Turn on multi-factor authentication everywhere, starting with email and remote access. Those are the doors attackers try first.

2. Move toward phishing-resistant methods like hardware security keys or passkeys. Texted codes are better than nothing, but attackers have learned to get around them.

3. Review who has admin rights. The fewer, the better. Every standing admin account is a prize waiting to be taken.

Where to start on Monday

• Pull a list of accounts without MFA and set a date to close the gap.

• Start phishing-resistant MFA with your administrators and executives.

• Remove admin rights nobody can justify, and require a request for the rest.

None of this is glamorous. All of it works. What's the one control your team keeps putting off?

Views are my own. Dave Trader is a CISO, U.S. Marine Corps veteran, and author of The Cybersecurity Endgame.