TECH INTELLIGENCE: Beware of zombies

It is tempting to dismiss zombies as a popular feature of apocalyptic movies – think of Brad Pitt in “World War Z” – but a particular kind of “walking dead” zombie, phantom records and accounts, can represent a real threat to businesses. However, working with an experienced cybersecurity consultant and following some relatively painless cyber-hygiene steps may offer a defense against these onslaughts.

The strategy of resurrecting dead records to mount attacks is a common phenomenon and may involve long-buried assets, like credentials that ex-employees still possess; old unused credit accounts at a retailer; a magazine subscription that lapsed a long time ago; or even an account at a professional services firm that is out of business or otherwise is no longer being used.

These dormant accounts are easy targets for hackers since they are not actively monitored and have not been used by their owners for extended periods. But they still retain important data, including credit card numbers, passwords, personally identifiable information and other sensitive intelligence that, like Hollywood zombies, can be reanimated by hackers and sold on the Dark Web — the hidden segment of internet sites that can only be accessed with a specialized web browser.

Through data dumps, cyber criminals routinely post volumes of stolen records on the Dark Web, putting up passwords or personal information that can be used for phishing and other attacks designed to get innocent users to click on infected sites or take other actions that can expose them to a cyber-attack. This kind of ambush can easily snare users who are not aware that their personal information and other data are up for sale and actively traded by the underworld.

To keep a business safe from zombies, unused accounts should be identified and deleted or disabled. Software should be updated, and all user accounts should be password protected. Business owners may also consider engaging a cybersecurity managed services provider that offers Dark Web monitoring services, which use a combination of human and sophisticated intelligence search capabilities to identify, analyze and proactively hunt the Dark Web for compromised or stolen employee and customer data. This way, if a business is alerted that email addresses, account numbers or other phantom information is appearing on the Dark Web, passwords can be modified and other corrective actions can be taken.

For example, every user in a business ecosystem should have a unique password made up of a combination of uppercase and lowercase letters, numbers and other characters. Once developed, these secure passwords should not be reused, and they should not be written down. Instead, a password manager or a software application like ITGlue or Passportal’s N‑able can store and manage online credentials, generating passwords that are usually stored in an encrypted database that itself is locked behind a master password. With this secure approach, a legitimate user only has to remember a single password.

Powerful passwords can also be reinforced with multifactor authentication. This critical cybersecurity tool bolsters the sign-in process by sending a secondary, additional identity verification – like scanning a fingerprint or entering a code received by a mobile phone or another device – to the user. So even if a criminal manages to harvest a zombie or other password, they will be blocked by the second-step MFA protocol.

Zombie accounts can place businesses and other organizations at risk, but launching a proactive and comprehensive suite of defenses can help to put these threats back in the grave while keeping personal and financial information safe and secure.

Carl Mazzanti is president of eMazzanti Technologies in Hoboken.