Lessons From Billions of Breached Records
summary
Service behind Have I Been Pwned ingests 11.7 billion records and shows concrete patterns: a 17‑year‑old using sqlmap causes the TalkTalk breach that costs £77M; CloudPets’ exposed MongoDB is deleted and held for ransom; TickTockTrack watches leak families by sequential API IDs (subtract one). Arbitrary password rules and mandated rotations produce predictable, weak credentials; NIST now recommends no composition rules and rotation only on suspicion. Recommendation: assume devices and services are untrusted and adopt zero‑trust and practical authentication controls.
AI-written summary · about
chapters (3)
related talks
48mLessons From Billions of Breached Records
46mKeynote: Lessons From 11 Billion Breached Records
01h 01mThe Internet of Pwned Things
25mTopics of Interest: An Attackers View on APAC's 2021 Three Major Breaches
50mHave I Been Pwned?
37mData Breaches: Barbarians in the Throne Room
46mRequiem for the Password
59mInside the Breach: Secrets Exposed