Welcome to The Senroc Download! The month of October is Cybersecurity Awareness Month. This month we’re bringing you a special series dedicated to the many forms a cyber attack can take, how to detect them, and ways you can practice with your team. The end goal will be the start of your organizations incident response plan!

In late August, the group behind a run of extortion attacks published data from a Carhartt breach covering 12.9 million accounts. Once the set of credentials is public, it joins a pool threat actors can download and test against every other service.

This is why a breach at a company you barely remember signing up to becomes your problem years later. The attack isn’t all that clever. The threat actors use a list of email addresses and passwords to test in bulk against Microsoft 365, bank websites, accounting platforms and any other platform worth gaining access to. However, the attack only succeeds if someone is reusing passwords.

And people do, overwhelmingly, reuse passwords because there was no alternative before password managers existed. The typical adult has tens of accounts and a handful of passwords with small variations between them. This isn’t carelessness. It’s just the most common strategy for anyone relying on memory to enter their password for their accounts.

Takeaway: Here is the uncomfortable truth. Your business email password protects every other platform you use because every account password can be reset through it. If any version of your work email password has ever been used anywhere else, its safety now depends on every company you’ve ever used that password with.

The habit this week is to stop trying so hard. Human memory is not the right storage medium for a hundred distinct passwords and most workarounds people invent to cope such as variations on a theme, a pattern, or a notebook in a drawer, can lead to having to reset your password regularly. A password manager helps you save your passwords, generate unique complex password for every service, and it can even fill the password automatically for your accounts to save you time.

A password manager leaves you with one complex password to memorize and that’s it! This password should prioritize length over being complicated such as using four or five unrelated words with a few numbers and symbols. Use multi-factor authentication for the password manager and for your email account to add an additional layer of security.

If your accounts offer passkeys, this can be another great way to secure your account with your face, fingerprint or device. Many companies are adopting this type of security including Microsoft, Google, Apple and a growing list of others. You don’t need to move everything at once, but turn them on where possible and get the rest as they become available.

Takeaway: Pick a password manager this week and start with adding a handful of accounts. Prioritize important accounts like your email, your bank, and whatever holds customer data. Utilize the business version to ensure every person in your organization can utilize the same password manager and securely access shared credentials for the entire company rather than passing them over email or Teams chat.

Go to haveibeenpwned.com, a free service run by a well-regarded security researcher, and enter your work email address. It will tell you which known breaches your address turns up in. Then do the same for any shared addresses within your company. The most common examples are info@, contact@, and the address you use on your website.

The list of compromises may be longer than you expect, but this is pretty normal rather than alarming. What’s important to note is whether the password you used for any of the accounts lists has ever been used anywhere else and in any other variation. These accounts are the ones you will want to fix first.

Once you’ve cleaned up your own accounts, then clean up your Microsoft 365 or Google Workspace account, an administrator should be able to run a report to list every account, when each last signed in, and which ones have multi-factor authentication switched off. Dormant accounts belonging to people who left the company are the ones attackers can exploit without anyone noticing because no one is there to see strange behavior on the account.

Takeaway: From the breach check: change any password that was reused anywhere, starting with email and banking. From the account list: disable anything belonging to somebody who no longer works at the company, and turn on multi-factor authentication wherever it’s missing. If you do nothing else this month, enabling multi-factor authentication for everyone produces the largest reduction in risk of anything else in this series.