Passwords are often the weakest link and for this reason, it is crucial for individuals and corporations to find alternative solutions that will provide a greater level of security. With World Password Day coming up on the 2nd May, it is the perfect time to address this cybersecurity issue.
https://twitter.com/cloudy_steve/status/1123862081089015808
Experts Comments:
Terry Ray, SVP and Imperva Fellow at Imperva:
Every user should have unique passwords for every website, or at the very least, have a unique password for every site you care anything about. Password managers are available – some for free and some for a fee, some for your computer, some for mobile and some for both – so there’s no real reason not to use one. Yes, it can be very annoying to not know your password and have to go look it up, but it’s more annoying to have your account hacked.
This is really about cyber hygiene. If we could, wouldn’t it be easy to have just one physical key in our life, that would drive all your cars, open your home’s doors, get you into the office and where ever else you need to be? Probably doesn’t sound like a very secure idea, but it would make for a smaller key ring. We don’t do this for physical security, yet almost everyone, even security professionals reuse some passwords. For those people, you should at least consider unique passwords for things that will make your life difficult when they get hacked.
For people looking to sharpen their password security this National Password Day, I recommend doing one of two things:
1) Change all of your passwords to something unique – and I don’t mean: Password1, Password2, Password3, etc. – something really unique. Use letters and numbers in nursery rhymes: “HDS4tOn4W@ll,” for Humpty Dumpty Sat On A Wall. Whatever works, put them in a password manager and move onto the next website. Turn on 2FA (two-factor authentication) whenever possible.
2) Prioritize your websites into important and unimportant. Do step one for all important websites and sacrifice the unimportant ones. Just never, ever use a password more than once for a website you consider important.
There are many factors in determining what characteristics make up an important website, but you can take some these and add your own:
- Contains obviously private data (phone, credit card number, social security number, address, bank account);
- Contains your or your family and friends’ pictures;
- Any work website;
- Healthcare websites;
- Insurance websites;
- Social media websites (you don’t want someone posting things you wouldn’t say);
- Dating websites (you don’t want people misrepresenting you, as you);
- Airline, rental car, hotel and other points websites (no need to give free vacations to hackers).”
Andy Cory, Identity Management Services Lead at KCOM:
“But in reality, the humble password, and the effective management of passwords, is one of the most important aspects of corporate defence. It doesn’t matter how strong your perimeter is, or how intelligent your breach detection – if authorised users’ accounts can be cracked open from the front, if their passwords can be guessed or stolen, then your company is as good as defenceless. Once an account has been compromised in this way, an attacker will often be able to gain access to a whole plethora of sensitive information, often without setting off any internal alarms, with incalculable potential impact for the organisation.
“With that in mind, good identity and access management should be the cornerstone of any cybersecurity infrastructure. Businesses must start by building an effective and resilient user authentication programme, ensuring that strong but usable password rules and multi-factor authentication is in place. As part of that, it’s also important to have a high-capacity cloud infrastructure in place that can effectively handle the authentication data – only then can you match user experience with security needs.
“Don’t underestimate the importance of passwords and good password management. Work with the right partner to build a resilient identity and access management system – before it’s too late.”
Rene Hendrikse, EMEA MD at Mitek:
“A network is only as strong as its weakest password. For businesses in financial services and the sharing economy that must verify the identity of every customer, a password doesn’t even guarantee that the right person is logging in. One solution is more stringent authentication measures, such as demanding increasingly complex passwords. But as secure as they might be, we all struggle to remember 12 characters with a capital, number, and symbol – never mind remembering this fifty times over.
“With complex passwords inevitably comes fewer passwords – or password-storing apps that provide an open door into a user’s whole identity. Both of these will ultimately fail to protect consumer identities and data online, and to prevent businesses from sophisticated cyber-attacks. We know that consumers are comforted by online security measures, as 27% have even abandoned a transaction due to a lack of security, according to Experian. But for businesses, finding the balance between security and customer experience will be crucial to their security strategy – and passwords aren’t the answer.
“Technologies such as digital identity verification could work alongside – or instead of – passwords to secure and verify customers’ identities online. This method enables a customer to upload an image of their ID document alongside a selfie, and the two are verified against each other using advanced AI and biometric face comparison technologies. While established text or email verification measures can be compromised by blunt force attacks, digital identity verification offers enough friction to help customers feel safe, and provides businesses with the multi-factor authentication they need in the age of the cyber-attack. All in all, a selfie can offer far more security than the password ever did.”
Juliette Rizkallah, CMO at SailPoint:
Todd Peterson, IAM evangelist at One Identity:
Rather, make sure that the controls around your passwords are good enough, and that you augment them wherever possible with multifactor authentication. By far the best practice is good passwordhygiene (as much complexity as possible), and – for high-value passwords – a password vault. The best option is a password vault augmented with session audit, analytics, and multifactor authentication, but this is generally only practical for high-value credentials like the Admin log-on.
Beyond that, adding a second factor such as a smart card, OTP token or biometric will dramatically increase the security of passwords”
David Warburton, Senior Threat Evangelist at F5 Networks:
The rise of authentication technologies, such as biometrics and facial recognition, come with promise of stronger security for online consumers but the cyber criminals seem to do a far better job of adapting to change than the rest of us. Biometrics can often be tricked and attackers increasingly use insidious social engineers tricks to get around hardware security tokens such as bank card readers.
“Attackers are increasingly relying on social engineering tactics, such as phishing, to deceive users and grab their names, addresses and passwords. These can then use this to access any sensitive data that is not protected by multi-factor authentication.
“This puts businesses in a delicate position. How can they ensure they continue to implement the strongest security policies and outsmart hackers to protect their sensitive data? The best route businesses can take is to consider the context under which access is being requested. Where is the user located? Is this normal for this person? Are they using a corporate or personal device and do those devices comply to company standards? While multi-factor authentication must become the norm, it should not stop at simply using a hardware or software token since these can and have been bypassed by criminals employing social engineering tricks. But, perhaps most importantly, organisations need to ensure continuous security training is available and compulsory for all staff.
“Ultimately, as hackers continue to refine and evolve their techniques, so must businesses. Continuously evaluating security practices and authentication methods is crucial to implement new habits stay on top of a threat landscape that shows no signs of slowing down.”
Rajesh Ganesan, Vice President at ManageEngine:
These accounts are typically protected by passwords and for teams running IT, these passwords are the keys to the kingdom, becoming one of their top priorities to fully understand the implications, devise a strategy and implement strong password management systems.
ManageEngine understands the problems and the needs of IT teams around managing the different types of accounts and passwords and has crafted solutions to empower them to completely be in control of information security.”
David Higgins, EMEA Technical Director at CyberArk:
“And then there are passwords that, if compromised, allow access to much greater rewards. Admin passwords are a key target for attackers and, due to operational challenges, are rarely managed to the level that they should be. With numerous examples of default admin passwords set on external facing servers being the access point to major data breaches, these represent the soft underbelly of the organisation. Basic level passwords that allow entry into the IT world will remain, in at least the near future, a true break glass issue.”
Cindy Provin, CEO at nCipher Security:
This tsunami of passwords that now exists across every aspect of our digital lives – both personally and professionally – has left us drowning in information that we are struggling to secure. With a thriving underground industry of hackers going to extreme lengths in order to get their hands on these credentials, both businesses and consumers need to be doing more to minimize the dependence and exposure of passwords.
For organisations, this means implementing techniques such as certificate based authentication or transparent database encryption to ensure passwords are as secure as possible. For consumers, it requires using a variety of unique and random passwords for every different application or website. It also involves an understanding of which credentials are being stored on which devices, and therefore how they might be vulnerable.”
Robin Tombs, CEO and Co-Founder at Yoti:
“With the development of password managers, help is at hand. They can securely store your login details – eliminating the need to remember all of your passwords. They can also generate stronger passwords and be secured with your unique biometrics rather than a master password – meaning only you can access and use your passwords. When it comes to protecting our online accounts and personal information, we should demand security, privacy AND ease of use – it shouldn’t be a trade off. Living in a digital age means the technology now exists to give people a simple and more secure way to log into websites, and World Password Day is a great time to promote this.”
John Fokker, Head of Cyber Investigations at McAfee:
“And the risks extend beyond our personal lives. McAfee found almost half of UK employees have experienced a breach while working for their current employer. Companies hold vast amounts of personal identifiable information on employees and consumers, making it imperative the right security is in place. Tight security and GDPR compliance requires collaboration beyond the IT team. CIOs should implement staff training and encourage the whole workforce – from employees through to partners – to use strong passwords to protect sensitive information, and make the potential risks of bad password hygiene clear.”
Colin Truran, Principal Technology Strategist at Quest:
Over the last 5 years we have seen two factor authentication become commonplace but it is still only a small step towards solving the password problem. Today things are starting to change and I am encouraged to hear many more organisations turning to multiple levels of biometric identification, including government bodies. Of course, it’s a huge responsibility to hold such biometric information in our consumer and user base, so this information must itself be protected by something better than a password! Let’s try to make this day a day of remembrance rather than a reminder of our reluctance to let go of an outmoded concept.”
Tim Erlin, VP, Product Management and Strategy at Tripwire:
.
.
Lamar Bailey, Senior Director of Engineering at Tripwire:
“Passwords are for assets you really don’t care about. Anything of value should be using better authentication methods and critical assets should be using multifactor authentication.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.