There is no such thing as an absolutely secure password in the world, and there never will be. Coupled with the general lack of security awareness among internet users, hackers are like participants in a children's egg hunt, but the prizes are far more tempting than chocolate bunnies.

The cyber threat environment is constantly deteriorating. Unlike IT departments, organized crime does not face budget cuts or layoffs; they are well-equipped and intelligent, said Russell Schrader, Executive Director of the National Cyber Security Alliance.

Increasingly cunning hackers continue to exploit lists of credentials, often obtained illegally, to breach security systems. Although no measure can fend off attacks forever, individuals and businesses can still take some basic steps to protect themselves.

How do hackers succeed?

Criminal software gangs engaged in illegal online activities, especially those operating abroad, have extremely low entry and organizational costs. Not to mention, a simple internet search can provide malicious users with everything needed to exploit proxy servers, botnets, and stolen credentials for intrusion.

However, password management and security best practices can at least mitigate security issues surrounding access permissions—issues that are becoming increasingly thorny as the boundaries between platforms and networks blur.

Jobert Abma, co-founder of HackerOne, points out that hackers currently bypass logins or passwords in three main ways:

  • Extracting weak credentials stored in plaintext or obscured with easily crackable encryption schemes;
  • Obtaining lists of credentials that users have used in other systems;
  • Exploiting other vulnerabilities to tamper with emails or passwords associated with websites.

To protect credentials in a business network, information should never exist in unencrypted form. Users often reuse credentials between business and personal accounts; once a password is compromised, hackers can use it to break into numerous other websites.

Andrew Jones, Principal Solutions Engineer at Shape Security, says that credential breaches typically do not involve real "hacking." More often, hackers possess lists of thousands of credentials and use proxy or botnet services to attempt logins on various websites.

Given frequent data breaches such as those at Equifax, LinkedIn, and Under Armour, there is a vast number of credentials available to hackers online. Jones says these lists are sometimes verified, allowing hackers to easily monetize stolen credentials rather than use them personally. Even if multi-factor authentication is enabled, hackers can still sell credentials that are valid only for the first layer of security verification.

Users can simply search on Troy Hunt's "Have I Been Pwned" website to confirm whether their email is associated with known breaches or credential databases. But by the time data is published online, it is often too late. Jones notes that for particularly sophisticated and malicious actors, this information may never be made public.

Best Defense

Currently, security experts generally agree that password management tools are the best option for individual users. Even though these tools themselves carry a risk of being hacked (a possibility that is not low), on balance, the additional security they provide is worth the risk.

For businesses, offsetting risks through more comprehensive security protocols can be a double-edged sword. Adam Bacchus, Director of Program Operations at HackerOne, says some restrictions do more harm than good, such as policies requiring frequent password changes.

In the most extreme case of balancing security and usability, the world's most secure computer is one that is unplugged, locked in a box, and thrown into the ocean.

But businesses cannot afford the luxury of perfect security and must walk a tightrope. Several security buffer measures that businesses can adopt include:

  • Two-factor authentication:Users may initially resist, but overcoming the initial hurdles can significantly enhance security control.
  • CAPTCHA and reCAPTCHA:These tests determine whether the other end is a real user, but as AI capabilities grow, what works today may fail a year later. Schrader says these tests must continuously evolve.
  • JavaScript challenges:Jones says these challenges force the visiting browser to run a piece of code; if it cannot execute scripts, it may indicate that the other party is a simple script on a botnet. They are simple to implement and low-cost, significantly enhancing security on many websites.

However, no matter how sophisticated security detection becomes, nothing is unbreakable. Businesses need clear contingency plans for data breaches, as well as response plans for stolen credentials.