From weak passwords to human error, many common security vulnerabilities can make an enterprise network susceptible to a cyberattack — and hackers are aware of them all.

In a session at the Impact Optimize conference on August 11, 2022, cybersecurity experts and red team members shared their advice for enterprise organizations seeking to prevent data breaches. Jeremy Haberkorn, Senior Cybersecurity Engineer at DOT Security; Nathan Golick, Senior Penetration Tester at DOT Security; and Wes Spencer, Vice President, Channel Chief at FifthWall Solutions and former chief information security officer (CISO) shared their insights gained from years in cybersecurity and penetration testing.

Common enterprise cybersecurity vulnerabilities

While searching for cyber exploits to gain access to enterprise networks, hackers typically look for simple ways to breach a network, according to Haberkorn. Hosting devices with default security configurations on an enterprise network is one common vulnerability the penetration testers saw frequently.

By leaving default security configurations enabled on networked devices, organizations leave themselves open to higher levels of cyber risk. Default settings and passwords is oftentimes publicly accessible on the internet. "We're able to go in there and just do a Google search and find out what the what the password is," said Haberkorn. Once login information is attained by an external actor, enterprise organizations are vulnerable to a data breach. 

Weak passwords are also a significant source of data breaches. From commonly guessed credentials ("password," "qwerty" and those containing company information, to name a few) to repeating passwords, users open their organizations up to risk by neglecting to adhere to password best practices.

Once a repeated password is obtained by bad actors, they can use it to gain further access to a network, creating a single point of failure for a widespread breach. "With single point of failure, that can be something that [penetration testers] really want to [identify] and find those as many places as possible in the environment," said Golick. By only using passwords once, users can reduce their enterprise's level of cyber risk.

Social engineering also presents a high level of risk to businesses, with external actors targeting an organization's employees to circumvent security controls in place. "Hackers are not going to necessarily go against firewalls or security solutions," said Haberkorn, "they're going to target everyone through their email. They're going to try to find people who... can be manipulated."

Email phishing is one example of social engineering — some actors will target specific individuals with social engineering attacks, learning the interests of their target to make their phishing email more urgent or important to the recipient.

Data breach prevention tips

Knowing common cybersecurity vulnerabilities in an organization is the first step to protecting the enterprise from cyberattacks. Haberkorn, Golick and Spencer shared best practices for reducing cyber risk in an organization, including:

• Change default security settings and credentials
• Build a security culture across the business with cybersecurity training
• Incorporate tools and processes for employee incident reporting

By following these steps, businesses can reduce their cyberattack surface and prevent largescale data breaches before they occur.