April 4, 2017 By Larry Loeb 2 min read

At February’s RSA Conference in San Francisco, Thycotic surveyed more than 250 security professionals about how they used passwords on their social media accounts. Surprisingly, 53 percent of respondents said they had not changed their social network passwords in more than a year. The firm also found that 20 percent of respondents have never changed their social media passwords at any time.

The survey highlighted how these unchanged passwords enable attackers to have continuous access to victims’ accounts. The longer a password is active, the more useful it is to fraudsters.

The Vulnerability of Social Media Accounts

A social network can act as a portal to other parts of a user’s online presence, including work matters. Some social networks have implemented OAuth-style authentication, which connects to other sites and apps. OAuth uses the social network to authenticate a user. If that social network is compromised, it can serve as a wide stepping-stone to other programs and information.

The survey also found that security professionals’ password quality wasn’t always up to snuff. It determined that 30 percent of respondents have used or are still using passwords made up of information related to birthdays, addresses and pets’ or children’s names in work situations. These are considered weak passwords since a determined adversary could derive them using public information and brute-force methods.

“Social logins create a major security risk because they become the master key for all other accounts,” Joseph Carson, chief security scientist at Thycotic, told SecurityWeek. “The problem stems further because it is not a proper vault and is used for more than just social logins — such as for communication, email, browsing and online shopping — so it is easily targeted and exploited.”

Setting Professionals Up for Success

However, it seems from this survey that even security professionals, who should be especially aware of security best practices, are leaving themselves at risk by using weak passwords and OAuth-style authentication for certain applications. Since social networks tend to allow default access rather than strictly authenticating users, a cracked password for a social account could enable fraudsters to access more critical, work-related data.

Thycotic advised security leaders and users to enable multifactor authentication whenever possible, expand and update security awareness training, audit and change passwords periodically and implement password management tools for minimized access and increased security.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today