Data breaches often use stolen credentials

According to the Verizon DBIR 2025, 88 percent of data breaches in the "Basic Web Application Attacks" category involve stolen credentials. This highlights the significant role that compromised usernames and passwords play in cyberattacks.

Most cyberattacks avoid using malware

The CrowdStrike 2025 report notes that 79 percent of detected cyberattacks in 2024 did not use malware. This indicates that attackers are increasingly relying on methods that do not require malicious software to be installed.

Time to move laterally is short

The same report found that cybercriminals typically move from an initially compromised machine to another within 48 minutes on average. This rapid lateral movement emphasizes the importance of detecting and containing breaches quickly.

Workstations are a blind spot

Workstations are a blind spot in network security due to their role in a trusted network environment. They maintain cached login information, which can be exploited if credentials are stolen.

Access rights determine the risk

A compromised identifier can open a perimeter that depends on the rights of the account. For example, a standard user account has limited access, while a privileged account can grant much wider access to the network.

Pass-the-hash techniques enable lateral movement

Techniques like pass-the-hash can be used to move laterally through a network by exploiting NTLM fingerprints without needing the password in clear text. This makes it easier for attackers to spread across the network.

Authentication design is outdated

Active Directory authentication was designed for a closed local network, where internal systems were considered secure. However, the rise of remote work has made this assumption obsolete, leaving workstations vulnerable.

Login and RDP are critical points

A password recovered by information stealing software can open a desktop session without detection, as no signal distinguishes a legitimate employee from an imposter. Adding a second factor at the Windows identity provider level can help distinguish between the two.

Privileged accounts need special attention

Best practices start with securing privileged accounts and administrators, as their compromise can lead to a full network breach. This should be followed by securing the rest of the network.

RDP requires additional security

While RDP uses network-level authentication (NLA), this does not constitute multi-factor authentication. Exposed RDP services remain vulnerable to brute force and credential replay attacks.

Reducing RDP risks

Measures such as adding multi-factor authentication (MFA) to RDP, limiting access through a gateway, and using the Restricted Admin mode can reduce the risk. These steps help limit the exposure of credentials on remote machines.

VPNs are a major entry point

According to the Beazley Security third-quarter 2025 report, 48 percent of ransomware attacks analyzed used compromised VPN credentials. This highlights the importance of securing remote access points.

MFA has limitations

While MFA via the RADIUS protocol enhances security, it is not foolproof. Methods based on simple notifications or one-time codes can be bypassed through phishing or session token theft.

CISA recommends phishing-resistant methods

CISA advises using phishing-resistant authentication methods like FIDO2 for sensitive access. These methods are supplemented by terminal status verification and network segmentation with reduced privileges.

Off-network workstations are vulnerable

Cached credentials on off-network workstations can be extracted and used for offline cracking. This is a separate technique listed in the MITRE ATT&CK framework.

Defending off-network workstations

Defenses include strong authentication that works offline, full disk encryption, and limiting the number of cached credentials. These measures make it more difficult for attackers to exploit stolen credentials.

Regulatory and human challenges

Implementing stronger authentication faces regulatory challenges, as the NIS2 directive requires multi-factor or continuous authentication in cybersecurity risk management. This depends on the applicable framework for each organization.

User fatigue from MFA

Frequent requests for a second factor can lead to user fatigue, resulting in mechanical validation. This highlights the need for an adaptive approach that strengthens verification only when the context is unusual.

Adaptive authentication strategies

An adaptive logic that strengthens verification in high-risk situations and lightens it when the risk is low is essential. This approach is part of the organization's access policy.

Specops Secure Access enhances security

Specops Secure Access is an extension of the existing Active Directory that adds a second factor to logins, RDP sessions, and RADIUS-based VPN access. It supports various verification methods and integrates with security information and event management (SIEM) systems.

Balancing security and usability

For IT decision-makers, the focus should be on identifying which access points still rely on a single line of defense and prioritizing those for improvement. This approach balances security with usability and practicality.