Defending Accounts from Credential Stuffing and Complete Takeovers

• Fraudulent account access is nothing new, but recent reports show a significant increase in this type of attack.
• With credential stuffing attacks and account takeover being closely related, it is important for organizations to take preventive measures against them.

What is credential stuffing?

Credential stuffing is a type of cyberattack that involves using passwords from a previous data breach and using automated login requests to attempt accessing various accounts. This kind of attack is especially harmful to sites that store sensitive data.

Here are a few things you can do to stay safe from credential stuffing attacks.

Flag unrecognized devices and new locations

Most account takeover attempts to use new devices.

• You can use IP addresses to verify if the account is being accessed from familiar devices and raise flags accordingly.
• Tracking new locations also helps prevent credential stuffing and account takeover. While some logins from new locations may be legitimate, you can always an extra step of caution by monitoring location.
• You can alert users in several ways in the case of a login. For an added precautionary measure, organizations can consider notifying users every time the account is logged into.

Enable multi-factor authentication

An additional layer of security such as security codes, biometrics, or security questions can help prevent a number of fraudulent account access attempts.

Restrict authentication requests

Organizations must consider implementing security policies that restrict the number of login attempts from a single IP within a particular time frame.

Draw up a password policy

Although setting strong and unique passwords is common knowledge, not many people take them seriously. Set policies that force password changes periodically and also ensure the basics of strong passwords.

Although these measures don’t completely foolproof accounts from credential stuffing attacks, they sure help you move few steps ahead in the right direction.