Why Resetting Passwords No Longer Stops Attackers
Traditional password security measures are becoming less effective as attackers shift to stealing session and token credentials to bypass MFA controls. Instead of focusing on securing logins, organizations must now prioritize protecting authenticated sessions and continuously monitor activity throughout the session lifecycle. This requires a shift in focus from password resets to actively revoking compromised tokens and limiting user privileges to contain the impact of a session breach.
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.
As attackers move away from directly stealing passwords and towards targeting session and token credentials, traditional password security measures are no longer sufficient. The rise of device-code phishing, where attackers trick users into entering codes from legitimate sign-in processes (often on devices with limited input capabilities), highlights this shift. Attackers are leveraging these stolen credentials to gain persistent access to accounts, even when multi-factor authentication (MFA) is enabled.
Organizations are increasingly struggling to defend against these attacks because attackers are operating with valid, reusable tokens and sessions. This means that a successful login doesn't necessarily represent a secure state – it’s the subsequent activity that matters. "The shift means the adversary arrives with valid credentials and a valid session," says John Laliberte, CEO and Founder of ClearVector. "Defenders who anchor their security program on the front door — passwords, MFA prompts, conditional access at sign-in — are defending a checkpoint the adversary has already walked past."
To combat this, organizations need to move beyond simply securing the login process and instead focus on continuously protecting authenticated sessions. This includes monitoring post-authentication behavior for anomalies, limiting user privileges, and revoking compromised tokens. Layering strict conditional access and session risk policies on top of these measures is also crucial. "Organizations need to treat sessions as requiring continuous validation, rather than granting continued access just because the user authenticated successfully at one point in time," notes Hayden Covington, associate director of security operations at Black Hills Information Security.
Furthermore, organizations must address identity sprawl across cloud platforms, SaaS applications, and third-party services, as OAuth abuse frequently relies on these trust relationships. "The question that matters is not 'Is this token valid?' but 'Does this activity make sense for this identity?'" Laliberte points out.
Finally, even password resets don't eliminate the risk – a password reset alone leaves every existing session alive, and the attacker remains connected. "We still have to walk clients through the fact that when you're triaging a compromised account, you need to explicitly revoke all active refresh tokens as a separate step." Denis Calderone, CTO at Suzu Labs, emphasizes the need for proactive measures beyond simply resetting passwords.