What is credential reuse?¶
The practical answer¶
Credential reuse is the use of the same or related authentication information across more than one account, system or service.
The key evidential caution¶
The dangerous assumption is that reuse proves the same person operated every account.
It does not.
Users may reuse passwords.
Administrators may use the same account across several systems.
Service accounts may be configured widely.
An offender may steal one credential and test it elsewhere.
Credential reuse may support lateral movement where the same password, account, token or secret works on another system.
What investigators should establish¶
Investigators should identify:
Key points¶
- which credential or account was reused
- where it was first obtained
- which systems accepted it
- whether the reuse was authorised
- what activity followed
- whether the account holder knew of the access
Evidential limits¶
Do not expose or reproduce live credentials unnecessarily.
Authentication records, account identifiers, password-change history, configuration and later session activity may help establish reuse.
A successful login on two systems may support the inference of credential reuse, but it may also reflect single sign-on, federation or a central directory.
The technical authentication model must therefore be understood.
Likewise, the same username across systems does not prove the same account or password.
Where central authentication is used, record whether the systems accepted one shared identity or merely similar usernames. This prevents a federated login from being mistaken for repeated password reuse.
The authentication architecture must be understood before the method is labelled.
Operational takeaway¶
Establish whether the same authentication material enabled access across systems, and keep credential reuse separate from personal identity and intent.