Pay particular attention to identifying LastPass installations installed as browser extensions, since they are not detected by most remote monitoring and management (RMM) and endpoint management systems by default.Monitor your managed devices for installed plugins, as not all users follow cybersecurity (opens in new tab) news and may be unaware of the problem.They should also follow best practices for passwords and enable multi-factor authentication (MFA) where possible.įor sysadmins, the following recommendations should be considered: To mitigate the risk posed by the LastPass breach, all users are advised to reset their passwords site-by-site, as simply changing the master password now would not solve the issue.

This puts both personal and corporate-managed users at risk, as the breach demonstrates the vulnerability of even well-established password managers. In fact, some data shows that 97% of the cloud apps used in the enterprise are cloud shadow IT. In this case, system administrators cannot enforce password best practices or manage password manager software. Uncontrolled use of password managers: While not all companies use LastPass, many employees install browser extensions themselves and use password managers for both work and personal credentials.Unfortunately, 53% of people reuse passwords for both corporate and personal accounts, which means that even if different password managers are used for work and personal purposes, a breach can cause major damage A lack of password best practices: Many end users do not maintain good password hygiene, including password reuse and weak passwords.Overall, this breach highlights several related issues that, when combined, can cause devastating consequences:

Last pass gen