Report Finds Government and Military Employees Use Weak Passwords

WatchGuard Technologies' Internet Security Report for Q2 2018 states that more than50% of military and government employees use weak passwords after analyzing the data leaked from LinkedIn in 2012.

According to their research, after analyzingpasswords associated with 355,023 government (.gov) and military (.mil) accounts from a 117 million encoded database of passwords stolen fromLinkedIn, over 50% of them were crackable in less than two days.

Furthermore, even though all government security training programs ask employees to use complex passwords to avoid providing hackers with an easy to exploit attack vector, the most common passwords throughoutthe analyzed database were"123456," "password," "linkedin," "sunshine," and "111111."

Granted, the dataset analyzed by the Threat Lab team comes from six-year-oldleak published online two years ago, but knowing what other research teams have found out about the passwords exposed in multiple other leaks in the past few years, the statistics most probably still hold out.

TheWatchGuard researchers also say that if the chosen passwords were at least medium-strength and not your run-of-the-mill "security codes," the time needed to crack them would have exponentially increased from a few hoursto weeks and even years for strong passwords.

"These findings further illustrate the need for stronger passwords for everyone, and a higher standard for security among public service employees that handle potentially sensitive information," says WatchGuard's report .

Moreover, the research team adds that besides better training of government employees in choosing stronger passwords, both state and privately-held organizations must use multi-factor authentication to bring down the prevalence of security incidents due to brute force attacks.

WatchGuard also found out that in over 75% of all malware attacks are performed over the web via HTTP/HTTPS, with brute force login placed on the fourthplace.

Threat actors use substantial numbers of login attempts in the hope of breaking in Internet-facing systems which can lead to disastrous credential exfiltration and significant losses over time.