Brute-force attack A brute-force attack breaks into an account by trying to log in over and over: automated tools work through password after password until one takes. It succeeds against short, weak and common passwords, and against systems that put no limit on failed attempts. It is not clever — it is only fast, and it can run for days.

Cloud IAM misconfiguration … holds more rights than it needs. In the cloud an identity is not merely a login. An identity is permission to read data, spin up resources, change networks, as …

Credential stuffing Credential stuffing does not go after unknown passwords; it tries known ones. With username and password pairs from databases leaked across the internet, the attacker tries the most-used services such as Facebook and Instagram, counting on people reusing the same credentials on several services — which in most cases holds.

MFA Fatigue MFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a confirmation the user has to approve on their phone. So the attacker starts the login over and over, burying the phone in approval requests. The arithmetic is simple: out of irritation, confusion, or the thought that it must be some glitch, the user approves one at some point — and the attacker is through the whole authentication.

Password spraying Password spraying is brute force turned around. Instead of trying many passwords on one account, the attacker tries common passwords across many accounts. That avoids lockout, because each individual account sees only an attempt or two.

SIM Swapping … The weak point is not the device but the shallow identity check at the operator.

Account Takeover … enormous, up to a complete takeover of a digital identity.

Authentication Bypass … rotected page. If a route exists, it has to check identity and access rights.

Deepfake Attack … s will carry on using voice and video as proof of identity. In a world where a voice can be copied, confirmation has to go through a procedure, an independent c …

Evil Twin … no longer attacking the network but the victim's identity.

IoT Device Compromise … acker each of them is a device with a network, an identity, software and vulnerabilities.

Kerberoasting … rberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — service accounts — under which most background …

Pass-the-Hash … ion (NTLM), the password is not required to prove identity; the hash is enough. Pass-the-hash abuses exactly that: if the attacker obtains a user's hash, they c …

Pretexting A good story is not proof of identity. The more detail somebody knows, the less it means they are legitimate and the more it means they prepared better.

Session Hijacking … r sensitive actions it is always worth asking for identity to be confirmed again, which you will often see on banking services. Session hijacking is close to to …

Token Theft … eady logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have …