When it comes to securing networks, data, and accounts, cybersecurity professionals often focus on advanced security controls and tools that can help identify and prevent malicious and suspicious activity. While this is valid, we may fail to spotlight the necessity for fundamental IT security practices before we can address more complex cybersecurity controls and implementations.

Based on a sample of NJ organizations, the NJCCIC found many organizations do not adequately follow industry standards for password management  or, more broadly, identity and access management. On average, local, non-privileged user account passwords were last changed nearly 1.5 years ago, while domain administrator account passwords were last changed well over three years ago. Given the rate at which passwords are compromised through data breaches, malware, and methods such as credential stuffing, changing passwords infrequently poses a significant risk to these networks. If passwords are obtained, the accounts are left open to access particularly when a secondary method of authentication is not required, as with multi-factor authentication  (MFA). If accounts are compromised, threat actors can use this access to obtain a foothold in the associated network and facilitate subsequent malicious activity.

A lack of restrictions on user permissions increases the risk associated with account compromises, as regardless of the user account, the threat actors will gain considerable network access. Identifying this access could be difficult as the threat actor uses a legitimate account to carry out their activity. By employing the Principle of Least Privilege , however, the damage associated with a compromised account is better contained, the network’s attack surface is minimized, and the risk of accidental or malicious misuse is reduced. This principle can be applied to users, administrators, and systems for improved cybersecurity.

In addition, the organizations sampled fail to apply patch management practices that adequately mitigate vulnerabilities, leaving critical vulnerabilities unpatched. Among the approximately 200 organizations sampled, over 33,000 critical vulnerabilities left unpatched are identified in CISA’s Known Exploited Vulnerabilities (KEV) catalog as actively exploited by cyber threat actors. Furthermore, many devices on these networks are end-of-life, such as Windows Server 2008 and 2012 and Windows 7, which means updates are no longer available and the devices are left vulnerable.