BROADCASTS.com

b'

All links and images for this episode can be found on CISO Series (https://cisoseries.com/defense-in-depth-account-takeover/)

An account takeover traditionally follows a methodical path that takes considerable time before anything bad happens. Is it worth a company\'s time and effort to be monitoring a potential account takeover at the earliest stages?

Check out this post\\xa0for the discussion that is the basis of our conversation on this week\\u2019s episode co-hosted by me,\\xa0David Spark\\xa0(@dspark), the producer of\\xa0CISO Series\\xa0and\\xa0Allan Alford\\xa0(@AllanAlfordinTX).\\xa0Our sponsored guest is Mike Wilson, CTO and co-founder, Enzoic.

Thanks to this week\\u2019s podcast sponsor, Enzoic.

Enzoic is an enterprise-focused cybersecurity company committed to preventing account takeover and fraud through compromised credential detection. Organizations can use Enzoic solutions to screen customer and employee accounts for exposed username and password combinations to identity accounts at risk and mitigate unauthorized access. Learn more about Enzoic.

On this episode of Defense in Depth, you\\u2019ll learn:

• Attack takeover (ATO) has a life cycle with multiple (6) steps. The first step is reconnaissance and you need to focus on that to stop the life cycle.
• There\'s plenty of talk about sharing OSINT (open source intelligence), but the reality is, and always been, that there are more consumers than contributors. Like any open source endeavor, it can only get better if more people contribute.
• Account takeover has at its root in stolen credentials, and as we know from sites like "Have I been pwned?" there are billions of stolen credentials floating out there that are consistently being used in credential stuffing attacks.
• What is your credential situation? How unique are they? Can they be learned?
• Start threat modeling your existing systems to determine what type of investment you\'ll need to make in account takeover.
• You can greatly reduce the risk of ATO by implementing multi-factor authentication (MFA) and privileged access management (PAM).
• The bad guys are playing the same game as we are and we essentially need to have better reconnaissance than them. Problem is they\'re sharing information freely and we\'re not.