💥 Brute Force… did we just make that up?

The answer is NO! This is a real IT term and we talk all about it in this recent podcast with our friends at MassMEP—if you haven’t had a chance to listen to it yet, tune in to this new podcast from our friends at MassMEP—Episode 89: "Brute Force, Credential Stuffing & Security Appliance, More than What You Originally Thought!"

Listen to the Full Podcast!

Check out the recap below, or tune in out wherever you like to listen to Podcasts—just search “MassMEP” or go to this link: https://massmep.org/podcast/ep-89-brute-force-credential-stuffing-security-appliance-more-than-what-you-originally-thought/

Podcast Recap—Brute Force, Credential Stuffing, Security Appliance & More...

Though Kevin and Hayley of MassMEP were convinced that the Synagex Cybersecurity Ninjas dreamt up these terms, we happily explained that we did NOT! We covered explanations of all of them—Brute Force, Bots, Credential Stuffing, Appliance Security, Zero Day Vulnerabilities in the podcast—Not to mention we stick to plain English and fun analogies so you can really get IT 😉.

If you don't have time to tune into the full version, read on for a brief review.

Defining Brute Force

Brute Force is a real IT term—it is utilized by bots to accomplish certain tasks. Think of brute force like having a janitor's key ring with thousands of keys on it, and trying every key until you get in.

"It's kind of like a vault. Brute force means you’re guessing… the whole concept of having your account 'lock out' was because of brute force attacks. Now, because of the dark web, these things are mechanized and they just wait until the lockout is lifted and then they try again." –John.

Defining Credential Stuffing

Brute force has morphed into credential stuffing—where more data is involved. Credential stuffing is a method using known credentials from other accounts obtained from data leaks in order to hack into an account.

Defining Bots

A bot or botnet is short for robot, or a virtual robot—bots can be good or bad! Bots are used by malicious actors to automate tasks, rather than a hacker sitting there and trying things one by one.

How to Prevent Brute Force and Credential Stuffing Attacks

Now that we know what brute force and credential stuffing attacks are, how do you protect yourself from these attacks? For individuals, we recommend using strong and complex passwords, as well as MFA wherever possible.

For businesses, there are further actions you can take to secure your systems against these kinds of attacks. A cybersecurity professional can help with controls like how many attempts before an account locks out, how long it is locked out, and installing firewalls that limit access.

Bots and Security Appliance Vulnerabilities

Security appliances are things like firewalls that protect computer systems from unwanted traffic. Security appliances are public facing and there’s bots out there looking for unsecured endpoints to get in. Think of it like a robot walking down the street looking for an open door… inevitably they’ll get in at some point.

Zero Day Attacks and Vulnerabilities

The zero day attack is not a known vulnerability yet—it’s zero days that the vulnerability has been known. A hacker might find a vulnerability in the code of a firewall that no one, not even the manufacturer, is aware of yet. You have no time to react to it! Furthermore, this news could spread amongst the hacker community and cause a spike in zero-day attacks of the same kind.

The best way to describe it is that you’ve had zero days to react to this vulnerability… which is why updating is so important! –Matt

Identifying and Securing the Gaps

Identifying holes in a business and having command over a single vulnerability might make you feel good in the short run, but there’s so much more to evaluate. At Synagex, we look at the whole picture with a security gap assessment—and the NIST framework is a great place to start.

An overall assessment will ask things like, "How is your password hygiene?" or "How do you manage potential risks?" So using a standard framework in an initial assessment to identify where you might have some cybersecurity holes is a great place to start. In the end there needs to be an overarching plan that addresses these weaknesses in a strategic way.

“If you say hey i heard this great podcast from MassMEP talking about brute force and I’m going to shut this thing down. Good for you, but there’s probably a 110 other things you need to look at as well. It’s great to make progress, but it's a lot!” - John

Getting Help to Get Started

Getting some help, identifying what some of these gaps are and getting advice in how to attack these things in a broader way is the best way.

MassMEP is a fantastic resource to start this journey because they have done the work to weed out any horrible IT companies that can’t give you good advice about your business.

Learn more about MassMEP here: https://massmep.org/

MassTech is offering grants to qualifying businesses to boost your business's cybersecurity. The grant money can be used to update firewalls, security appliances, servers, etc. Take it from us, this MMAP grant opportunity is incredible—it's an investment, but the opportunity is a slam dunk.

Learn more about MassTech Here: https://masstech.org/

And Finally, Synagex is a Modern IT provider offering cybersecurity and CMMC gap assessments across the country. We specialize in making IT simple and work to separate ourselves as a ITaaS provider that can understand your business, how it works, and the challenges—and provide simple, plain English solutions. (And by English, we mean SIMPLE!)

“We’ve been studying IT our whole lives… were just born geeks. But, I own a business myself, and when we start getting around tax season and we're getting into the weeds with accounting, I want to poke my eye out. I don’t even know where to start, I just want help. So I can only imagine what it feels like to be a manufacturer or to own a small business and to be concerned about this sort of a topic and trying to find the time to deal with it—Cybersecurity is such a broad topic. To make matters worse, even if you go to find help, IT companies can be a pain in the butt to deal with. We work pretty hard to try to separate ourselves." –John

Kevin and Hayley started this podcast with a simple question: "If you were to open up your own business, what would you do if you needed to implement cybersecurity?"

To which Kevin quickly responded, "Go hire someone who knows what they’re doing!"

We're here if you need IT, folks!