Author: Johnty Mongan
Password protection is the first line of defence against cyber threats. With 94% of passwords reused or duplicated1, many individuals who manage multiple accounts across personal and professional domains often simplify or reuse their passwords for convenience. This creates vulnerabilities that can be exploited, making it the primary target for threat actors.
The increased use of AI in cyber-attacks and phishing attempts has heightened this risk. Threat actors can automate billions of password-guessing attempts within minutes.
Additionally, AI can now mimic voices and generate realistic images, enabling attackers to impersonate colleagues or executives with alarming accuracy and trick unsuspecting employees into sharing their credentials.
"Practicing good password hygiene, paired with tools like multi-factor authentication and intrusion detection systems, is essential for building real cyber resilience," says Johnty Mongan, global head of Cyber Risk Management at Gallagher.
The AI threat: Guessing passwords from social media
AI supercharges brute-force attacks
A brute-force attack attempts to gain unauthorised access by systematically guessing usernames, passwords, or other credentials. With the adoption of AI, attackers can now automate the process, analyse large datasets and test combinations at scale, significantly increasing the speed and success rate of brute-force attacks.
AI technologies can extract information from social media profiles to predict potential passwords. It identifies patterns in human behaviour, such as the use of pet names, birth years or common phrases, and uses these insights to generate targeted guesses with precision.
Consider a social media post where an individual shares a photo celebrating their 40th birthday, holding a balloon that reads "Happy 40th!" The caption mentions, "Celebrating with my dog Bella," and their name, Sarah Jones, is visible on the profile. A threat actor could correlate this information to generate likely password combinations such as Sarah1985, Bella40, or JonesBella1985.
What makes this threat particularly potent is AIs ability to automate the analysis of vast volumes of data across multiple platforms. It enables threat actors to scale their efforts and refine their predictions with precision. This is a stark reminder to avoid using personal information in passwords and regularly update credentials.
The role of secure passwords and passphrases
Maintaining secure and unique passwords that include a combination of symbols, numbers and letters for each of your accounts makes them much harder to predict. Passphrases, with four or more words, can be a more secure alternative. Using a series of words or a meaningful sentence increases password entropy, making them easier to remember but difficult to crack. Including special characters between words can further add to the unpredictability of the password and strengthen it against brute-force attacks.
Best practices for password security
- Enable two-factor authentication (2FA): For additional security, enable 2FA whenever possible. This requires a second verification step, such as a code sent to your phone or biometric/fingerprint confirmation, as well as your password.
- Use password managers: Use password managers to store and manage passwords securely. These tools generate strong passwords and help you keep track of them without compromising security.
- Create complex passwords: Incorporate a mix of uppercase and lowercase letters, numbers and symbols. Avoid easily guessable information such as names or birthdays.
- Use passphrases: Consider passphrases, which are longer but often easier to remember than complex passwords. A passphrase can be a sequence of random words or a sentence with numbers and symbols.
- Change passwords regularly: Update passwords and passphrases regularly to minimise the risk of unauthorised access. This step is critical if you suspect information may have been compromised.
How Gallagher can help
By adopting strong passwords, updating them regularly and implementing additional security measures like two-factor authentication, individuals can fortify their digital defences and safeguard their personal and professional data.
In addition to following best practices to secure your devices and online accounts, keeping up with the evolving cyber threats remains critical. To assist in your organisation's security, the Gallagher Cyber Defence Centre offers real-time updates on common vulnerabilities and the tools available to boost your cybersecurity posture.
Contact the Gallagher Cyber Risk Management team for personalised advice and solutions. Our specialists will guide you in implementing robust cybersecurity measures and developing a strategic cybersecurity approach tailored specifically to safeguard your organisation’s future.
