Identity Governance and Administration | LastPass 

Discover Identity Governance and Administration (IGA) and its benefits. Learn how LastPass enhances security and compliance through effective IGA solutions. 

What Is Identity Governance and Administration?

What is Privileged Identity Management? | LastPass 

Discover the importance of privileged identity management and how LastPass helps protect sensitive accounts. Enhance security with advanced access controls. 

Understanding Privileged Identity Management 

In a recent data breach, threat actors targeted customers of Snowflake, a cloud data warehousing platform, without resorting to advanced hacking techniques. Instead, they exploited exposed, legitimate credentials to access accounts and ultimately steal data for extortion purposes. This incident underscores the vulnerabilities associated with credential management and the risks posed by infostealers and stolen credentials. Snowflake may be one of the biggest breaches of 2024, yet we still don&rsquo;t know the full extent of the impact or how many companies have been affected.
In late May, a financially motivated threat actor known as UNC5537 advertised data allegedly obtained from major companies like Ticketmaster and Santander on a cybercrime forum, claiming these breaches were facilitated through access to Snowflake. Several companies were not aware they had been compromised with infostealers, so their credentials were available on the dark web. According to analysis done by Snowflake and cybersecurity firm Mandiant, the threat actors accessed individual customer accounts by leveraging these stolen credentials. One critical factor that enabled the breach was the lack of multifactor authentication (MFA) on the affected accounts. Without MFA, logging in with legitimate credentials is often sufficient to gain unauthorized access. 
Mandiant's investigation estimated that the threat actors could have accessed the accounts of approximately 165 companies using these compromised credentials. While victims from the breach will continue to come out, we have seen some major impacts so far. Some of the biggest victims to date include Advance Auto Parts, Ticketmaster&rsquo;s Live Nation, Santander, Lending Tree, and most recently AT&amp;T. 
This breach emphasizes the ongoing threat posed by infostealers and the ease with which attackers can exploit weak security measures. Organizations are urged to enhance their security protocols, particularly by implementing MFA, ensuring vigilant credential management, and monitoring for cyber campaigns targeting vendors to safeguard against similar attacks in the future.
So far this year, there have been several simple password spraying or credential harvesting type attacks that have led to massive impacts. These incidents highlight the cyber threats around how exposed credentials can significantly elevate threats to enterprises of all sizes.
Read more in our commentary here: <a href="https://www.darkreading.com/threat-intelligence/snowflake-account-attacks-driven-by-exposed-legitimate-credentials">https://www.darkreading.com/threat-intelligence/snowflake-account-attacks-driven-by-exposed-legitimate-credentials</a>.

Cybercriminals Target Snowflake: How Simple Tactics Led to a Major Data Breach

In a recent data breach, threat actors targeted customers of Snowflake without resorting to advanced hacking techniques. Instead, they exploited exposed, legitimate credentials to access accounts and ultimately steal data for extortion purposes. This incident underscores the vulnerabilities associated with credential management and the risks posed by infostealers and stolen credentials. 

Strong passwords are a lynchpin of business cybersecurity. Your organization's cyber defenses are only as strong as your weakest password. According to the 2023 Verizon Data Breach Investigations Report (DBIR), 86% of breaches involve stolen credentials. This Change Your Password Day, use the opportunity to educate employees on <a href="https://blog.lastpass.com/2023/03/take-5-steps-toward-better-password-habits/">the latest best practices for setting secure passwords</a>. Change Your Password Day is the perfect time to start making positive changes to improve your organization's password security.
<h3 aria-level="2">Tips for Change Your Password Day</h3>
Not all passwords are created equal. Following simple rules will go a long way towards reducing the impact of weak, stolen, and mismanaged passwords. On Change Your Password Day, reinforce these password security essentials:
<ol>
 	<li aria-level="3">
<h4> Length Matters</h4>
</li>
</ol>
One of the fundamental principles of a secure password is adequate length. Given today's supercomputers that can crack 6-character passwords in seconds, longer passwords (a minimum of 12 characters) provide an additional layer of complexity, making it more challenging for attackers to hack into an account. 

A <a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener">password generator</a> is an automated, secure tool that instantaneously creates long, randomized passwords. These complex passwords typically include uppercase and lowercase letters, numbers, and special characters, making them harder to guess or crack through brute-force attacks. Generated passwords are not based on easily guessable patterns, making them more secure than passwords users might create. For reference, these are the top 10 <a href="https://cybernews.com/best-password-managers/most-common-passwords/">most common passwords</a>:
<ol>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">123456</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">123456789</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">qwerty</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">password</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">12345</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">qwerty123</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">1q2w3e</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">12345678</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">111111</li>
 	<li data-leveltext="%1." data-font="Segoe UI" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559683&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0,46],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">1234567890</li>
</ol>
Password generators save users time and effort while ensuring the passwords meet high-security standards. Users can specify the length, character types (uppercase, lowercase, numbers, special characters), and other parameters to align with organizational security policies. Using unique and random passwords for each account reduces the risks of credential reuse, ensuring that a compromise on one account does not jeopardize others.
<ol start="2">
 	<li aria-level="3">
<h4> Secure Storage is Key</h4>
</li>
</ol>
Encourage employees to use a <a href="https://www.lastpass.com/products/business" target="_blank" rel="noopener">password manager</a> to streamline and enhance their password security. A password manager like LastPass makes complex, generated passwords more achievable because users only need one master password to access and manage their account credentials for all other logins.

Password managers offer several benefits that contribute to improved security, convenience, and overall user experience. In addition to integrated password generators to create strong and complex passwords, password managers store login information in an encrypted vault. A centralized platform helps users easily view, organize, and update passwords. Browser extensions automatically fill in login credentials for websites and applications. The tight browser integration saves time and reduces the likelihood of falling victim to phishing attacks by preventing users from entering passwords on fraudulent sites.

While it may seem like "putting all of your eggs in one basket," a password manager significantly improves security through encryption and device-level security. Without access to the master password, the data remains inaccessible and unusable for attackers. Additionally, these tools often include features like two-factor authentication (2FA) for an added layer of security. Password managers often have features that analyze the strength of existing passwords and alert users to potential security vulnerabilities. This proactive approach helps users identify and update weak or compromised passwords promptly.

In summary, password managers are crucial in promoting strong cybersecurity. On Change Your Password Day, emphasize the benefits of strong, unique passwords for every website while only remembering one master password with the help of a password manager like LastPass.
<ol start="3">
 	<li aria-level="3">
<h4> Security Dashboards Offer Visibility</h4>
</li>
</ol>
Regularly monitoring the security of your passwords is crucial. On Change Your Password Day, leverage a Security Dashboard to assess your organization's security score and see how it <a href="https://blog.lastpass.com/2022/01/creating-an-effective-business-password-policy/">aligns with your password policies</a>. A password manager's security dashboard serves as a centralized hub for monitoring and enhancing the security of stored passwords, providing valuable insights into password strength and highlighting potential vulnerabilities. Regular check-ups allow for proactive measures, ensuring the identification of weak passwords and prompt updates to at-risk accounts. 

Password managers like LastPass offer a Security Dashboard to evaluate password length, complexity, and uniqueness. The dashboard can calculate a comprehensive security score based on password strength, account security settings, and product usage, providing at-a-glance statistics on security at a user and organizational level. By offering insights into password security at the account level, including when they last updated the password, security dashboards can help users proactively identify and update weak or compromised credentials. Dashboard integration with dark web databases can also help identify passwords compromised in previous security incidents. Users can take immediate action, such as changing passwords or enabling additional security measures.

Many security dashboards display the two-factor authentication (2FA) status for each account. Enabling 2FA adds an extra layer of security by requiring an additional verification step beyond the password. The dashboard can prompt users to enable 2FA and flag suspicious logins from unfamiliar locations or devices, allowing users or admins to take corrective actions like changing passwords or locking down an account.
<ol start="4">
 	<li aria-level="3">
<h4> Go Passwordless</h4>
</li>
</ol>
Embrace <a href="https://www.lastpass.com/features/passwordless-authentication" target="_blank" rel="noopener">passwordless authentication</a> for the ultimate protection against unauthorized access. Passwordless authentication providers like LastPass eliminate the need for traditional passwords by replacing them with more secure and user-friendly methods, like biometrics or hardware tokens. On Change Your Password Day, explore passwordless authentication to enhance security and simplify the user experience while reducing the risk of password-related vulnerabilities.

Passwordless authentication eliminates traditional passwords, reducing the risk of common attacks such as brute force, credential stuffing, and phishing. Passwordless methods rely on unique and inherently secure factors, minimizing the vulnerabilities associated with traditional password weaknesses and creating a significant barrier to unauthorized access.

Passwordless authentication can incorporate 2FA for an extra layer of security by combining multiple factors such as biometrics, device recognition, or one-time passcodes. Some passwordless methods rely on the inherent security of the user's device, ensuring that only authorized devices can access an account.
<h3 aria-level="3">Move security forward on Change Your Password Day</h3>
If your employees still need to implement the above password security best practices, Change Your Password Day is a timely reminder to reinforce them. You can significantly reduce credential-based breaches by implementing lengthy passwords, utilizing password managers, checking security dashboards, and exploring passwordless authentication. Strengthening your organization's password security with a solution like LastPass will better safeguard sensitive information in an increasingly complex cybersecurity landscape. Learn more <a href="https://www.lastpass.com/contact-sales">here</a>.

Celebrate Change Your Password Day

Strong passwords are a lynchpin of business cybersecurity. Your organization's cyber defenses are only as strong as your weakest password. According to the 2023 Verizon Data[..]

Generative AI is here, and we're still trying to make sense of what it could mean for us on an individual and societal level. At the same time, cyber attackers are thinking about how they could use generative AI to launch more effective phishing attacks at scale. The question is not if but when hackers will leverage generative AI and phishing to target businesses with even greater precision and relentlessness. To help your company prepare, here's what you need to know about generative AI, how it could be used in phishing attacks, and how to protect your business from this evolving cyber threat.
<h3 aria-level="4">What is generative AI?</h3>
Generative AI is a form of artificial intelligence that can create text, audio, images, and other types of content. ChatGPT is perhaps the most famous example of generative AI, or gen AI for short. It can be used as a chatbot, just like other kinds of AI, but that's just the tip of the iceberg. You can have ChatGPT create emails, essay outlines, and other written materials for you in an instant. Although what you get back may not be of the exact same quality as what a human would create, it's surprisingly close.

Just like any other technology, ChatGPT and other kinds of generative AI are basically agnostic. That is, they can be used for good purposes as well as bad ones. Businesses may use gen AI to provide multilingual customer support or debug code – two arguably beneficial use cases. On the flip side, cyber criminals can also use gen AI to create phishing emails, and that spells trouble for anybody who cares about their company's cybersecurity. 
<h3 aria-level="4">How is generative AI being used in phishing campaigns?</h3>
Bad actors can use generative AI to whip up traditional phishing emails in far less time than it takes to craft those messages by hand. An expert in social engineering at IBM estimates that while it usually takes her team about 16 hours to build an effective phishing email, a generative AI model can create a highly convincing one <a href="https://securityintelligence.com/x-force/ai-vs-human-deceit-unravelling-new-age-phishing-tactics/" target="_blank" rel="noopener">in just five minutes</a>. It will soon be cheaper and less labor-intensive for cyber criminals to target companies with phishing emails than it was before generative AI stormed onto the scene.

Because these AI-generated emails usually aren't riddled with spelling errors and other oddities that make them easy to identify as fraudulent, your employees might be more likely to interpret them as legitimate. On top of that, cyber criminals can use ChatGPT and other large language models (LLMs) like it to make their phishing emails more relevant. Because LLMs are able to consume massive amounts of data, they can be directed to stay up to date on breaking news events, posts appearing on a company's social media accounts or website, or other trusted information sources that could help the message appear more credible. 

Armed with these snippets of intel, a generative AI tool could quickly propagate a highly effective business email compromise (BEC) campaign that targets your CEO, your finance team, or other employees in key positions at your company. If they don't think to independently verify the message using another channel before clicking on the link contained in the message, you could have a ransomware attack on your hands.
<h3 aria-level="4">How can you protect your business from generative AI phishing attacks?</h3>
As you can tell, generative AI and phishing are an explosive combination. Although it's wise to be concerned about how bad actors could use gen AI to come after your business, the news isn't all bad here. For starters, <a href="https://blog.lastpass.com/2023/08/offense-defense-ai-in-cybersecurity/" target="_blank" rel="noopener">AI in cybersecurity</a> could help companies ward off these kinds of attacks in the future. In the meantime, there are some easy, common-sense steps you can take right now to strengthen your defenses before these supercharged phishing campaigns start showing up on your doorstep. 
<h3 aria-level="5">Update your security awareness trainings</h3>
If you're not already offering regular security awareness trainings to your employees, now is a great time to get started. By giving your staff the information they need to clock a potential phishing email, you can reduce the chances that they will be tricked by one and end up putting the business at unnecessary risk. 

If you've been conducting security awareness trainings for a while, be sure to update them with the latest guidance on how to spot newer and evolving scams like AI phishing campaigns. For example, you'll want to let employees at your company know that while bad grammar and typos were once reliable signs of a phishing email, that's no longer the case in the age of generative AI. 
<h3 aria-level="5">Look out for phishing attempts on other channels, too</h3>
Although email has long been the communications channel of choice for phishing campaigns, it's not the only one. <a href="https://blog.lastpass.com/2023/06/the-evolution-and-adaptability-of-phishing/" target="_blank" rel="noopener">Phishing has proven remarkably adaptable</a> since it first cropped up about 25 years ago. A crafty phishing message may slide into your direct messages (DMs) on social media, pop up on your phone as a text message, or even arrive in the form of a suspicious voice mail message (that one's called vishing). Since hackers are just starting to explore how generative AI and phishing go together, it's not a stretch to imagine that these kinds of campaigns will become more frequent and sophisticated in the future – or that cyber attackers might use AI to initiate multichannel campaigns so they can increase their chances of success.
<h3 aria-level="5">Use a password manager</h3>
A password manager can also help you stay one step ahead of phishing attacks. You can use a password manager to make sure employees are only able to enter their passwords on verified domains, which stops most phishing attacks in their tracks. A phishing email often directs its victims to fake websites that are carefully designed to look like the real thing, inviting them to enter their passwords and provide other sensitive information that cyber criminals can then scoop up and use as they please. With a password manager restricting password entry to verified sites only, you can significantly reduce the chances that your employees will accidentally enter their passwords on fraudulent sites.
<h3 aria-level="4">Get ready for generative AI phishing attacks</h3>
While AI can be a tool for good, it can unfortunately also be used for nefarious purposes. Cyber attackers are already considering how generative AI could help them launch highly effective phishing campaigns in less time. <a href="https://blog.lastpass.com/2023/09/dont-panic-a-good-password-is-still-smarter-than-ai/" target="_blank" rel="noopener">Don't panic</a>, though. There's time to prepare. By taking a few simple steps to protect your business now, you will be in a stronger position to prevent AI phishing attacks from compromising your business as they start showing up.

Generative AI and Phishing

Generative AI is here, and we're still trying to make sense of what it could mean for us on an individual and societal level. At the same time, cyber attackers are thinking [..]

Ahead of Cybersecurity Awareness Month, we hosted a LinkedIn Live featuring LastPass Principal Security and Privacy Awareness Specialist Sanna Nissinen, PhD and special guest Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance, where they provided valuable insights and resources to help your organization get ready for October. 

Watch below to learn how to educate and empower your employees, partners, and customers to stay safer online.

<div id="embed"><iframe width="560" height="315" src="https://www.youtube.com/embed/0KcCK2a8sZE?feature=oembed" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" name="fitvid0"></iframe></div>

The Password[less] POV: Cybersecurity Awareness Month

Ahead of Cybersecurity Awareness Month, we hosted a LinkedIn Live featuring LastPass Principal Security and Privacy Awareness Specialist Sanna Nissinen, PhD and special guest [..]

When we visualize the process of logging into our login accounts, we almost always think of entering passwords (and, if we're being honest, struggling to remember them, then resetting them, and finally trying to log in again). While that old process is familiar and maybe comfortable in a way, the future of authentication is quickly approaching. Here's how your business can prepare for a more secure and user-friendly login experience – one that doesn't rely on passwords.
<h3 aria-level="4">Why it's time to move on from passwords</h3>
We've been in a stalemate with passwords for years. We have too many passwords to keep track of, and it's troublesome to come up with a unique and complex password for each and every site or app we use. On the other hand, we know what passwords are and how to use them. Why switch to passwordless authentication now when we already have something in place, even if it's not ideal?

Passwords make us vulnerable to serious cyber threats and the problem is getting much worse as time goes on. It's far too easy for bad actors to <a href="https://blog.lastpass.com/2020/10/how-do-hackers-get-passwords/" target="_blank" rel="noopener">steal, guess, or even buy</a> one of our online passwords as it is. They are even buying and selling entire packages of passwords on the dark web, all wrapped up in a bow. Once they have one of our passwords, these cyber criminals can then use it to log into that account. As if that scenario wasn't bad enough on its own, it can actually get worse from there.

If our password hygiene isn't so great and we've re-used that same password for multiple accounts, then it's incredibly easy to go and log into those accounts, too. In fact, cyber attackers can use automated tools to do this too. If they manage to get into an employee's work account, for example one that is used to access corporate financial data or customer information, then they've just hit paydirt without breaking a sweat. 

According to the <a href="https://www.verizon.com/business/resources/reports/dbir/?cmp=knc:ggl:ac:ent:ea:na:8888855284&amp;utm_term=verizon%20dbir&amp;utm_medium=cpc&amp;utm_source=google&amp;utm_campaign=GGL_BND_Security_Exact&amp;utm_content=DBIR2023&amp;ds_cid=71700000082347933&amp;ds_cid=&amp;gclid=CjwKCAjwtuOlBhBREiwA7agf1oKr7b2DUWkwYMJj2gdReXlO8y_IlDmXy58eZlY_fpzxlriCSqEzrhoCAQQQAvD_BwE&amp;gclsrc=aw.ds" target="_blank" rel="noopener">2023 Verizon Data Breach Investigations Report,</a> 49% of breaches by external actors involved the use of stolen credentials like passwords. Clearly, this situation is not ideal for anyone who relies on the internet to go about their business at work or in their personal lives. This is why we need new authentication methods that are more secure.
<h3>Why the future of authentication is passwordless</h3>
The way we log into our online accounts is about to change. Rather than simply relying on a password that anyone could use if they got their hands on it, the authentication process will soon be passwordless. 

Facial recognition and fingerprint scanning are already in place at certain businesses, and some employees are also becoming more comfortable with using them on their personal devices. Because it's much harder to steal or fake someone's face or fingerprint than it is to get their password, these forms of <a href="https://blog.lastpass.com/2023/05/you-are-the-password-understanding-biometric-authentication/" target="_blank" rel="noopener">biometric authentication</a> will make it tougher for cyber attackers to compromise employee accounts. Although it sounds like the stuff of sci-fi, logging in with your face or your finger will soon be commonplace – and it will be a lot easier than fumbling around for that password that you can't quite remember.

Other passwordless authentication methods are coming soon, too. Passkeys are intended to replace passwords altogether. Each passkey will be unique, composed of a public key that resides with the website or app in question as well as a private key that lives only on the user's device. Not only will this design make it much harder for a cyber criminal to get their hands on a user's passkey in the first place, but they also won't be able to use one passkey to access multiple accounts like they currently can with passwords. 
<h3 aria-level="4">How to help your employees adjust to passwordless authentication</h3>
If you're an IT leader or a business executive, then you may be wondering how to help your users or employees navigate the learning curve involved with the switch to passwordless authentication. One way to help them prepare for the change is to ask them for feedback about the challenges they have with passwords today. Their input will help you understand what their user experience is like when trying to log in, where the pain points are, and how it could be improved. 

Once you've gotten that feedback, you can make an informed decision about which passwordless authentication methods are right for your business. Some businesses will be using a mix of passwordless technologies depending on their needs; for example, they may choose to implement biometric authentication in combination with passkeys. Others may go in a different direction, opting to first dip a toe in the water with multi-factor authentication before considering a fully passwordless route. 

Whatever course you decide on, be sure to offer your employees plenty of educational resources to help them adjust to the transition. This can take the form of security awareness trainings, online video courses, handy cheat sheets, or something else altogether. The important thing is to make sure your staff knows why the change is coming and that they have the support necessary to make the adjustment – especially if they're working from home.
<h3 aria-level="4">Get ready for the future of authentication</h3>
The future can seem like a scary place, but with a little knowledge, it can transform into a secure one with fewer passwords to stumble over. <a href="https://blog.lastpass.com/2022/06/passwordless-is-possible-lastpass-gets-you-there-sooner/" target="_blank" rel="noopener">Passwordless is possible</a>, especially if you begin laying the groundwork for the transition now. By preparing for our passwordless future today, you can set your employees and your business up for a safer and easier login experience.

Discover how LastPass enables your business to <a href="https://www.lastpass.com/contact-sales" target="_blank" rel="noopener">go passwordless</a>.

The Future of Authentication: A World Without Passwords 

When we visualize the process of logging into our login accounts, we almost always think of entering passwords (and, if we're being honest, struggling to remember them, then[..]

Passwords are familiar – everybody knows what they are and how they work – but due to poor password hygiene behaviors, they also come with some serious security issues . <a href="https://www.lastpass.com/resources/ebook/psychology-of-passwords-2022" target="_blank" rel="noopener">Sixty-two percent</a> of people still reuse passwords, making themselves vulnerable to cyber attacks and data breaches. This is partly because, after a certain point, it becomes impossible to remember every password you have given that each password should be unique and complex for every account you have (most people have up to 50 online accounts!).

Thankfully, passkeys are about to make this process a whole lot easier. Instead of relying on passwords alone to safeguard a rapidly growing number of online accounts, you will soon be able to use convenient passkeys as an alternative. Here’s what to know about passkeys, how they work, how they’re different from passwords, and how they will help protect your online accounts.
<h3 aria-level="4">What is a passkey?</h3>
A passkey is a form of passwordless authentication that allows you to log into apps and websites more quickly, easily, and securely – in place of a password. A passkey also makes the process of signing up for a new account far smoother. If you’ve ever wished you could ditch passwords in favor of a more user-friendly approach that also strengthens your cybersecurity, this is likely welcome news.

Technically speaking, a passkey is a cryptographic key pair that includes one public key (which is shared with the relying party website) and one private key (which is stored directly on the user’s device). Both of these keys are required for a user to successfully authenticate and then log into an account that has been protected with a passkey. 
<h3>How do passkeys work?</h3>
When you set up a passkey to access an app or a website, you’re essentially getting rid of the password authentication mechanism you’ve used for years. This means that instead of having you log in with a regular username and password, the site will ask you if you’d like to log in using your passkey. LastPass will take it from there, automatically filling that passkey in for you so you can log in and be on your way. 

Passkeys will work on most devices that people use at work and in their personal lives. You’ll be able to create, save, and manage passkeys right in your LastPass vault, meaning you’ll be able to access your passkeys everywhere you already use LastPass, regardless of the operating system or platform you’re currently on. Crucially, the experience will feel the same everywhere you go, reducing the learning curve when transitioning to a new system for authentication.
<h3 aria-level="4">How are passkeys different from passwords?</h3>
If a cyber attacker was able to guess, crack, or steal a person’s password, they could usually log in as that person and, from there, get free rein to rummage through their data. If the user had re-used that same password across multiple accounts, then the attacker could leverage that password to get into those accounts, too – especially if multi-factor authentication (MFA) was not enabled on those accounts. 

Passwords have made people vulnerable to phishing, and from there, damaging breaches –a whopping 80% of data breaches happen as a result of compromised credentials. Cyber criminals often buy and sell large collections of stolen passwords on the dark web, making it even easier for a password to be used without its owner's knowledge. Passwords could also be compromised if someone happened to see the password being entered (a phenomenon called shoulder surfing) – say, at an airport, a café, or a park.  

Passkeys, by contrast, are much more secure by default. Because they’re unique and cannot be re-used across multiple websites and apps, bad actors cannot use passkeys to compromise multiple sites at the same time. And since only one half of a passkey – the public key – is saved on the website or app in question, a hacker will not be able to get into the account if they don’t have ready access to the user’s device, which stores the private key. 

Passkeys also use strong encryption algorithms, making it much harder for attackers to crack them – there is no such thing as a weak passkey – in contrast to a password. All of these security improvements introduce new barriers for malicious actors that are trying to obtain unauthorized access to your online accounts.
<h3 aria-level="4">Prepare for the passwordless future</h3>
Passkeys are coming soon, and with them, the dawn of our passwordless future. Although a passkey relies on sophisticated technology, it will ultimately usher in an easier and safer login experience for you. If you’ve wished that you could do away with passwords in favor of a better method, that moment is fast approaching – and the time to prepare is now.

Discover how LastPass enables <a href="https://www.lastpass.com/security/passwordless-authentication" target="_blank" rel="noopener">passwordless authentication</a>.

How Do Passkeys Work?

Passwords are familiar – everybody knows what they are and how they work – but due to poor password hygiene behaviors, they also come with some serious security issues</span[..]

When you store your passwords in a password manager, how do you know they're actually secure? At a minimum, that password manager should encrypt all of your passwords. That's not enough, however. To truly protect your business data, your password manager should use a zero-knowledge security model. Here's how zero-knowledge encryption works, why it matters, and how it keeps your passwords safe. 
<h3 aria-level="4">How does encryption usually work?</h3>
To understand what zero-knowledge encryption is, it's helpful to know how regular encryption usually works. When you encrypt data, you're putting it under lock and key. By making that data illegible to anyone who doesn't have the decryption key, you're shielding it from prying eyes. No one else but you can see what your data contains, let alone do anything with it, unless they have the decryption key that was created when you encrypted that data. 

Businesses find encryption helpful from a security standpoint. For example, encryption can come in very handy if an unauthorized person or organization tries to access your business data. If they can't see what's in your encrypted data and they don't have the key to open it up, they essentially hit a dead end. The only downside, of course, is that anyone who does have the decryption key could take a peek, or, worse, use that data as they see fit. 

For example, a software provider that encrypts your business data for you could theoretically grant someone else access to your data or be forced to do so without your knowledge. If an unauthorized party stole the decryption key from your provider, that could also <a href="https://blog.lastpass.com/2022/04/infographic-doing-nothing-could-mean-losing-everything/" target="_blank" rel="noopener">put your business at risk</a> and you would be none the wiser. To head this potential vulnerability off at the pass, many forward-thinking software providers are moving toward a zero-knowledge security model.
<h3 aria-level="4">What is a zero-knowledge security model?</h3>
Zero-knowledge gives the key to you and you alone. In a zero-knowledge encryption scenario, no one except you, not even your provider, can decrypt your data and find out what's inside. Because only you have the key or password to access your encrypted data, you can have greater confidence that no one else will be able to access that data without your permission and knowledge. 

Strictly speaking, zero-knowledge is an overall encryption methodology rather than a specific encryption protocol like AES-256. A zero-knowledge security model makes sure that your data is encrypted before it leaves your device, while it is in transit, and when it is stored at its destination (for example, a server or a cloud storage service). Because a zero-knowledge approach encrypts your data at all of these different stages, each of which has its own unique technical requirements, it may use a combination of encryption protocols (such as AES-256 and TLS) to get the job done. 
<h3 aria-level="4">What is zero-knowledge proof and how does it work?</h3>
But what if your key or password gets stolen, you might ask? Well, the zero-knowledge approach has an answer for this potential problem, too. A zero-knowledge security model requires that you store your key somewhere safe – that is, somewhere that a third party could never access it. 

When the time comes to access your encrypted data, then how do you prove that you have the right to do that? After all, passwords are typically a two-way affair: a user provides the password, and the system receives it. Upon verifying that the password is correct, the system grants access to that user. Instead of using traditional passwords or decryption keys, a zero-knowledge security model uses an authentication process called zero-knowledge proof to confirm that you are authorized to access the data.

Rather than asking you for the password or key itself, a zero-knowledge proof approach asks you to provide evidence that you have it. By successfully responding to a series of challenges, you can verify that you are who you say you are and get the green light. Many software solutions like password managers and cloud storage services now handle this zero-knowledge proof authentication in the background, automatically taking care of it for you so you don't have to fumble around looking for your details each and every time you want to use your data.
<h3 aria-level="4">The benefits of zero-knowledge encryption</h3>
Zero-knowledge gives you greater peace of mind that not only is your business data under lock and key but that only you have that key. Rather than worrying about whether someone may have stolen or borrowed the other key from your provider and then started poking around your data without your awareness or consent, you can rest assured that you've taken the steps necessary to keep your business data shielded from anyone who would want to view, use, or manipulate it.

A zero-knowledge security model is especially useful for any business that uses a password manager to secure and store its passwords. With a zero-knowledge approach, you can rest easy knowing that no one else but you, not even your password manager vendor, has the keys to the kingdom. After all, you wouldn't want anyone else to be able to see the passwords you use to access critical business, IT, and financial accounts. By design, a zero-knowledge approach makes sure that no one else can do that.

When your password manager uses a zero-knowledge security model, you can more easily trust it with your passwords. For example, zero-knowledge means that no one has access to your master password for LastPass or the data stored in your LastPass vault, except you (<a href="https://blog.lastpass.com/2022/03/forgot-your-password-your-guide-to-lastpass-account-recovery/" target="_blank" rel="noopener">not even LastPass</a>). This way, you can enjoy all the business benefits of a password manager without worrying about whether someone else might be able to access your business data. 
<h3 aria-level="4">Achieve better password security with a zero-knowledge approach</h3>
You want to be sure that your provider is taking all the right security measures to protect those passwords and <a href="https://blog.lastpass.com/2021/04/how-lastpass-keeps-your-business-safe/" target="_blank" rel="noopener">keep your business safe</a>. Unless you know a fair amount about cybersecurity, though, you're probably taking them at their word when they say they're following cybersecurity best practices. By choosing a password manager that uses a zero-trust security model, you can be sure that only you have access to your passwords – and you can achieve the peace of mind that comes with better password security. 

Discover how LastPass' <a href="https://www.lastpass.com/security/zero-knowledge-security" target="_blank" rel="noopener">zero knowledge security</a> safeguards your data.

How Zero Knowledge Keeps Passwords Safe

When you store your passwords in a password manager, how do you know they're actually secure? At a minimum, that password manager should encrypt all of your passwords. That'[..]

In today's digital age, the compromised credentials crisis poses a significant threat to individuals and businesses. The frequency of data breaches highlights the vulnerability of traditional password-based authentication systems. As cybercriminals exploit weak passwords, it's evident that companies need a new approach to ensure robust security. The solution? Pervasive password[less] protection reduces the reliance on credential-based authentication and strengthens organizational security through a more comprehensive solution.
<h3 aria-level="2">The need for fewer passwords</h3>
Passwords are the most common form of online authentication. In terms of back-end technology, they're easy to implement, quick to scale, and inexpensive to maintain. However, the proliferation of corporate accounts and third-party services has saddled employees with dozens, sometimes hundreds, of passwords to track and secure. Because traditional password-based authentication systems often require users to remember multiple complex passwords, employees are more likely to experience password fatigue, create weak passwords, or reuse passwords across accounts. Those poor password practices increase the risk of costly data breaches and disruptive cyber fraud.

Companies must <a href="https://blog.lastpass.com/2023/05/assessing-and-improving-your-businesss-cybersecurity-posture/" target="_blank" rel="noopener">accurately assess their password security</a> and reduce dependence on passwords, eliminating or replacing them entirely where possible. The fewer passwords you use, the more secure you are. Companies can significantly enhance their security posture while simplifying the authentication process for end users by adopting passwordless login methods, such as biometrics. By replacing credential-based authentication with biometrics, for example, companies eliminate the typical weaknesses of passwords while employees enjoy a more streamlined login process.
<h3 aria-level="2">Characteristics of a pervasive solution</h3>
To effectively combat the compromised credentials crisis, a pervasive solution must:
<ol>
 	<li> Approach passwords as a user experience problem. Employees shouldn't waste valuable time or mental effort logging in to do their work. Repeated login attempts, forgotten passwords, mandatory password changes, and looking up passwords in a document or notebook; all slow employees down and create friction in their workflow. Password management should be seamless, intuitive, and user-friendly. By prioritizing the user experience, organizations can encourage safe password practices and streamline employee access without compromising security.</li>
 	<li>Empower IT with robust admin experience, reporting, and policies. Most IT admins need more administrative control and visibility to evaluate, enforce, and improve password security. Disjointed technology infrastructure and Shadow IT can prevent admins from standardizing a password policy and ensuring employees always follow it. IT administrators require powerful tools to manage and enforce security policies effectively. A pervasive solution should give admins granular control over password policies, comprehensive reporting capabilities, and streamlined user provisioning and de-provisioning processes. IT admins can target standardization at the organizational level and increase compliance at the individual level.</li>
 	<li>Continuous measurement of password health. A pervasive solution should include a way to report on the strength and security of passwords across an organization. Regular password health checks and automated alerts with targeted recommendations can help identify potential vulnerabilities and proactively mitigate risks. While admins can review reports at the organizational level, employees can also review their personalized security report to see areas needing improvement.</li>
 	<li>Understand and shape user behavior and adoption. Strong cybersecurity is only possible with user compliance. Employees are an inescapable part of a company's cyber defense. That's why companies must train employees with the proper knowledge to be effective members of the cybersecurity strategy. And they should equip users with helpful technology that makes strong cybersecurity practices the norm. A solution should offer insights into user behavior patterns, enabling organizations to tailor awareness campaigns, provide targeted training, and encourage the adoption of passwordless authentication methods.</li>
 	<li>Integrate with existing cybersecurity stack. Addressing the password crisis shouldn't require a "rip and replace" approach to existing technology. A truly pervasive solution should seamlessly integrate with an organization's cybersecurity infrastructure. Compatibility with popular identity and access management systems, user directories, single sign-on solutions, and multi-factor authentication tools ensures a cohesive security ecosystem that enhances protection across all access points. Such a solution should also protect access at the employee level, creating an organizational umbrella that captures and secures access to digital apps and services outside of IT's direct control, too. </li>
</ol>
<h3 aria-level="2">LastPass as a pervasive solution</h3>
By securely storing passwords and generating unique, complex passwords for each account, LastPass eliminates the need for individuals to remember multiple passwords. The master password is the only key to access all stored credentials, enhancing security while reducing the cognitive burden on users.

LastPass provides robust administrative controls, allowing IT teams to enforce password policies, manage user access, and generate detailed reports. LastPass empowers organizations to maintain a strong security posture while ensuring regulatory compliance. Furthermore, LastPass integrates with various cybersecurity tools, enabling organizations to create a cohesive security ecosystem tailored to their unique needs.

Continuous monitoring and assessment of password health are integral to LastPass. Users receive alerts for weak or compromised passwords, encouraging them to adopt stronger security practices. LastPass enables every employee to be an effective part of the company's cyber defense strategy, while reducing workflow friction and password-related hassles. 

The compromised credentials crisis demands a paradigm shift in approaching authentication and password security. True pervasive password[less] protection reduces reliance on passwords while providing comprehensive security coverage. By adopting passwordless login methods and leveraging advanced password management solutions like LastPass, businesses can enhance their security posture, protect against data breaches, and elevate the employee authentication experience.

<a href="https://www.lastpass.com/products/business" target="_blank" rel="noopener">Learn</a> how LastPass can help with your organization's journey to passwordless.

Pervasive Password [less] Protection: The Solution to the Compromised Credentials Crisis

In today's digital age, the compromised credentials crisis poses a significant threat to individuals and businesses. The frequency of data breaches highlights the vulnerabil[..]

In today's interconnected world, businesses across the globe face a daunting challenge—the compromised credentials crisis. This pervasive problem affects all sectors, endangering sensitive data and posing substantial risks to organizational security. Ultimately, the compromised credential crisis threatens the financial health, stability, and brand equity of companies everywhere. What is contributing to this crisis, and what can business leaders realistically do about it?
<h3 aria-level="2">Poor security hygiene and an expanding attack surface</h3>
After years of high-profile data breaches, cybercriminals have amassed databases of billions of account credentials and other personal information. What is driving the theft of these credentials? Poor security hygiene and an ever-expanding attack surface. These databases of stolen credentials, in turn, lead to more data breaches when employees fail to adopt better password hygiene (<a href="https://www.lastpass.com/resources/ebook/psychology-of-passwords-2022" target="_blank" rel="noopener">only half</a> will change their password after a breach).

Many employees <a href="https://blog.lastpass.com/2022/05/are-your-employees-making-these-password-mistakes/" target="_blank" rel="noopener">need to improve their password habits</a>. Password reuse across multiple accounts is common, and many people also create weak, easily guessed passwords. Their motivation may be benign - to make passwords easier to remember and use - but the results are problematic. 

When it's easy for hackers to steal, guess or crack employee passwords, they can more readily access critical systems and take valuable data. Sometimes a simple password is all that stands between a hacker and a company's most significant assets. Data breaches seem inevitable when employees frequently mishandle passwords and companies fail to reinforce digital access points with added security measures.

Moreover, the hybrid work environment combining remote and on-site workers and increased digital collaboration between employees and third parties have significantly amplified the number of credentials used across an organization. With so many entry points, including cloud services, email platforms, and third-party applications, the attack surface has multiplied. A rapidly increasing attack surface makes it harder to defend against cyber threats effectively, requiring new strategies and solutions.
<h3 aria-level="2">The compromised credentials crisis in action</h3>
Phishing attacks (social engineering), malware infections, and brute force attacks represent the most common methods through which credentials hackers steal passwords. Phishing emails or messages cleverly impersonate legitimate sources, tricking employees into disclosing their login credentials. Once obtained, hackers can exploit these credentials to gain unauthorized access to corporate systems, causing substantial damage.

Malware infections pose another significant risk. When employees inadvertently download or execute malicious software, keyloggers or password-stealing malware can capture login credentials and transmit them to attackers. Stolen credentials then compromise the security of individual accounts and the entire organization, potentially leading to data breaches and financial loss.

Brute force attacks involve systematically attempting many password combinations until finding the correct one. This method relies on weak or commonly used passwords, which hackers can easily decipher when leveraging large databases of stolen passwords. With high-powered computers, cracking software can guess many weak passwords in seconds. A successful brute force attack then allows hackers to impersonate employees and infiltrate systems undetected, endangering sensitive data and compromising organizational security.
<h3 aria-level="2">Combatting the compromised credentials crisis</h3>
To address the compromised credentials crisis, organizations must:
<ol>
 	<li data-leveltext="%1." data-font="Avenir Next" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">Accurately <a href="https://blog.lastpass.com/2023/05/assessing-and-improving-your-businesss-cybersecurity-posture/" target="_blank" rel="noopener">assess their current cybersecurity posture</a>, including its strengths and weaknesses.</li>
 	<li data-leveltext="%1." data-font="Avenir Next" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">Reduce their reliance on passwords.</li>
 	<li data-leveltext="%1." data-font="Avenir Next" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">Enhance the security of every entry point to their digital assets.</li>
 	<li data-leveltext="%1." data-font="Avenir Next" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:0,&quot;335559684&quot;:-1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">Strengthen password security where they cannot eliminate credential-based authentication. </li>
</ol>
Traditional security measures like single sign-on (SSO) and multi-factor authentication (MFA) are no longer sufficient to combat this crisis. Why? Because employees adopt an ever-changing roster of third-party apps and services to improve their productivity and performance in the workplace. Not every login will be vetted and provisioned by IT (shadow IT). That means adopting security solutions that provide security at the user level, no matter where the user is logging in from, and what they're logging in to.

Passwordless authentication methods, such as biometrics (fingerprint, facial recognition) and hardware tokens, offer a more secure alternative to traditional passwords. These methods significantly reduce the risk of password-related attacks and enhance overall security by removing weak password habits and authenticating with data points that are much more difficult to steal or impersonate.

In addition, organizations should implement a comprehensive security framework that includes continuous employee education and training programs. These programs emphasize the importance of strong, unique passwords, encourage the use of password managers, and guide employees in recognizing and avoiding phishing attempts.
<h3 aria-level="2">Taking the next step</h3>
Companies must recognize the pervasive threat posed by the compromised credentials crisis in order to address it. When organizations are proactive about password security and data protection, they can better reduce the risk of data breaches and mitigate the potential damage of a successful cyberattack. Strengthening existing password security is a first step, but businesses that rely on fewer passwords will be better poised to navigate the cybersecurity challenges of the coming years.

<a href="https://www.lastpass.com/products/business" target="_blank" rel="noopener">Learn how</a> LastPass can help your business strengthen password security.

The Compromised Credentials Crisis: A Challenge Plaguing the Cybersecurity Industry

In today's interconnected world, businesses across the globe face a daunting challenge—the compromised credentials crisis. This pervasive problem affects all sectors, endang[..]

You're familiar with malware, and you know how to spot a phishing email. But have you heard of bloatware? Although it's not as well known, bloatware can also saddle your business with serious cybersecurity risks. Here's what bloatware is, why it's dangerous, and how you can prevent it from compromising your company's sensitive data.
<h3 aria-level="4">What is bloatware?</h3>
Malicious software can be designed to carry out nearly any sort of task. Ransomware holds data for ransom until a fee is paid, spyware stealthily peers at your online activities, and old school computer viruses were notorious for simply laying waste to computers and the data on them. Bloatware, by contrast, merely seems annoying at first. It appears in the form of unwanted and potentially harmful software that a manufacturer or even your cellular carrier has loaded onto your device before selling it to you. 

There are several different kinds of bloatware. Trialware, for example, might offer you a free trial of the software for a limited period of time before badgering you to purchase a license. Adware is another common form of bloatware, interrupting you with pop-up ads while you're trying to get some work done. Manufacturers may also pre-install system utilities and applications that you don't particularly want to use. 

As the name suggests, bloatware can slow down your device and make it sluggish. Unfortunately, even if you're not using any of the bloatware at all, it still consumes a certain amount of system resources. And so, as a result, you may find yourself with a shiny new device that doesn't actually perform very well. Although you didn't ask for the bloatware, you got it – and now you have to figure out what to do about it.
<h3 aria-level="4">Why is it dangerous?</h3>
Say, for argument's sake, that you don't really mind if there's extra software lying around on your device. Is it really that big of a concern? Unfortunately, yes. Unless the company that installed the bloatware on your device can verify that it is free of vulnerabilities and will stay that way well into the future, it could put your business at risk of a man-in-the-middle attack or digital surveillance at some point. And in that scenario, any data that device can access could be made visible or even accessible to a bad actor. This includes customer data, intellectual property, or other sensitive information that could seriously harm the company if it were revealed to the public in a data breach.

Supply chain attacks, in which bad actors find their way into corporate networks using vulnerabilities found in third party software, are one of the most serious threats facing businesses right now. According to the <a href="https://www.verizon.com/business/en-gb/resources/2022-data-breach-investigations-report-dbir.pdf" target="_blank" rel="noopener">Verizon Data Breach Investigations Report for 2022</a>, supply chain attacks were responsible for 62% of system intrusion incidents that year. So as much as businesses don't want to deal with yet another cyber concern, bloatware should be on the list alongside the other threats that IT and security teams spend so much time warning their colleagues about.
<h3 aria-level="4">How can businesses prevent it?</h3>
As with other cyber threats, you must first know how to identify bloatware in order to address it. There are a few telltale signs to keep out for when determining whether a piece of software is, in fact, bloatware. First of all, if you don't know what it is or how it got on your device, then you'll want to take a careful look at it. If the application implores you to make a purchase, that's a definite red flag. Pop-ups are another tell-tale sign of bloatware. It may also be difficult or impossible to use, and removing it from your device may be a lot harder than it should be. 

How can you delete bloatware? Oftentimes, your IT team can use mobile device management (MDM) software to find it and remove it. If you're an individual user who has administrative privileges on your device, you might be able to remove it yourself, but some bloatware will try to trick you into visiting fake websites and using fraudulent removal tools that could also harm your device and compromise the business. So just to be safe, it's best to ask your IT colleagues for help in getting rid of any software you suspect might actually be bloatware.

At a high level, your business should consider combating bloatware by including anti-bloatware policies in its cybersecurity strategy. This way, IT will have guidance on how to deal with the bloatware it might find on devices that have just been purchased – ideally, before those devices are given to users. If your company has a <a href="https://blog.lastpass.com/2022/01/how-to-manage-the-risks-of-byod-in-a-work-from-anywhere-world/" target="_blank" rel="noopener">Bring Your Own Device (BYOD)</a> policy, IT will also need a game plan for how to handle bloatware on employees' personal devices. Likewise, it's a good idea to include bloatware in your regular security awareness trainings. That way, along with the usual tips on how to spot phishing emails and avoid <a href="https://blog.lastpass.com/2022/05/are-your-employees-making-these-password-mistakes/" target="_blank" rel="noopener">making password mistakes</a>, everyone at your company will learn how to deal with bloatware, too.
<h3 aria-level="4">Get rid of bloatware and keep your data safe</h3>
Bloatware seems harmless at first, but it's not so innocent. At best, it can make your device run slowly or sluggishly. At worst, it can contain vulnerabilities or outright malicious features that compromise your business and its sensitive data. By looking for bloatware on your company devices and educating users on how to identify it, you will not only be able to rid your business of an annoying productivity drain, but you will also be able to better protect your business from serious cyber threats.

Discover how <a href="https://www.lastpass.com/business" target="_blank" rel="noopener">LastPass</a> provides proactive security for every entry point.

What Is Bloatware, and How Can You Get Rid of It?

You're familiar with malware, and you know how to spot a phishing email. But have you heard of bloatware? Although it's not as well known, bloatware can also saddle your bus[..]

Blog

Blog

Recent

Industry News

LastPass For Admins

LastPass Labs

Product Updates

Tips And Tricks

Security News