A "security policy" may be ineffective without a "security culture" - (Evidence) According to Ponemon’s 2019 State of Password and Authentication Security Behaviors Report, extremely poor password management habits by those in IT are making a hacker’s job much easier.

51% reuse the same password across an average of five business and/or personal accounts. It seems "Eating your own dog food" does not apply to IT


This is in line with LastPass’s 2018 findings where 50% of users use the same passwords for work and personal accounts


https://blog.knowbe4.com/a-hackers-dream-half-of-it-admins-reuse-passwords-across-multiple-accounts

Unbeleivable - Oman's stock exchange had both its username and password as "admin"

For several months, Oman's stock exchange, one of the largest stock exchanges in the Middle East, was reportedly vulnerable to hacking

ZDNet reported that a security researchers found that a primary Huawei router for Oman's stock exchange had both its username and password as "admin".

It is not uncommon for many routers to have the same username and password combination set as default. However, unless manually changed, leaving the combination as is, would reportedly allow hackers to gain administrator privileges, which in turn would give them complete control over the device.

The vulnerable router's IP address buried in a list of Telnet credentials that were leaked last year

For More:
http://www.ibtimes.co.uk/security-gaffe-left-omans-stock-exchange-vulnerable-hackers-months-1655820

25 common passwords of 2017

Top 10 

1. 123456 
2. password 
3. 1234567
4. qwerty
5. 12345
6. 123456789 
7. letmein
8. 1234567
9. football
10. iloveyou

Rest in the link

https://www.wombatsecurity.com/blog/worst-passwords-of-2017-deja-vu-all-over-again?utm_content=65637682&utm_medium=social&utm_source=twitter

Fact is stranger than fiction - Hawaii’s missile alert agency keeps its password on a Post-it note

As Business Insider describes, evidence has come to light that some of the organisation’s staff might be in the habit of sticking Post-it notes containing passwords onto their computer monitors.

That in itself is far from ideal, but what’s even worse is that these Post-it note passwords have been caught on camera by the media, and available for anybody to view on the internet

For More:
https://hotforsecurity.bitdefender.com/blog/hawaiis-missile-alert-agency-keeps-its-password-on-a-post-it-note-19461.html

Android Whatsapp users should be aware that when we DELETE a message ,it stays (sounds Strange?)

WhatsApp messages that are deleted are actually still on the device and can be easily accessed


This is according to a report from the Spanish Android blog Android Jefe, which found that deleted WhatsApp messages – at least, the first 100 characters – can be read off of the notification log of the device.

    What we found is that the messages are stored in the notification register of the Android system. So, it’s just a matter of entering that record to see the messages that the other person deleted.

Notification History is a hidden feature that first got added in Android 4.3. Hidden it may be, but there are apps on Google Play that will happily reveal it for you


For More:
https://nakedsecurity.sophos.com/2017/11/16/deleted-whatsapp-sent-messages-might-not-be-gone-forever/

Fact is stranger than fiction: 50% of Ex-Employees Still Have Access to Corporate Applications

According to 20 percent of the respondents, failure to deprovision employees from corporate applications has contributed to a data breach at their organization. The research found that nearly half (48 percent) of respondents are aware of former employees who still have access to corporate applications, with 50 percent of IT decision-makers ex-employee’s accounts remaining active once they have left the company for longer than a day. A quarter (25 percent) of respondents take more than a week to deprovision a former employee and a quarter (25 percent) don’t know how long accounts remain active once the employee has left the company. 

The study finds close to half (44 percent) of respondents lack confidence that former employees have been removed from corporate networks at all.

More Here:
https://www.onelogin.com/company/press/press-releases/new-research-from-onelogin-finds-over-50-of-ex-employees-still-have-access-to-corporate-applications