Industry practitioners concerned about weak passwords within the workplace need to understand that the solution to addressing this does not lie in the regularity in which passwords are changed but in the entire flawed process of password security systems, which needs to be abolished, according to Dave Worrall, CTO at Secure Cloudlink. Verizon recently released its annual Data Breach Investigations report, which reports on the major security breaches and methods used by hackers to compromise businesses and governmental organisations. One of the critical findings within this revealed that 63 per cent of confirmed data breaches surveyed were facilitated by compromised credentials, meaning they were caused by stolen or weak passwords.
The findings went onto suggest that a key contributor for weak and stolen passwords resulted from end users not changing default passwords. It also offered advise stating that firms should mandate all staff to change their passwords at least four times per year with more specific rules consisting of at least eight characters with an uppercase, lowercase, number and special character. While these recommendations should go some way to halting immediate threats, Worrall suggests it won’t eradicate them. In essence, we’ve reached a tipping point when it is time to rethink the entire system of password driven security:
“The findings from the Verizon report discussing the volume of data breaches being directly linked to compromised credentials are hardly shocking. The reality is most current password systems for business applications and websites are flawed. They are based on designs, which were deemed acceptable ten years ago but are simply not suited to cope with the modern demands and threats placed on it. Instead of trying to find better solutions, the IT industry has chosen to remain stagnant with its approach to password management and this is ultimately compromising users. It is essential action is taken to address this.”
Worrall continued: “The explosion of social media sites, businesses transacting online and the proliferation of mobile devices and applications in the workplace, means people are being forced to juggle multiple passwords across multiple interfaces. On top of this the need to refresh passwords on a regular basis combined with using a mix of letters, numbers and special characters only compounds further confusion.
“For a lot of users the easy option of simply keeping the same password across multiple applications and devices, and having the mind-set that “this won’t happen to me” often outweighs the effort required to manage this process effectively – this is something unlikely to change. This renders the password as an untenable means of authentication because of their fundamental security vulnerabilities, which is only accelerating by the dramatic shift to mobile computing and the ever-rising tide of data breaches.
“Ultimately, the password security system is there to try and make the user’s life easy while making the attacker’s life harder. Password security systems that ignore the user are going to fail the very community they are there for in the first place. Whenever users cannot manage a password driven security system, they are giving an advantage to an attacker who will be more than happy to try and exploit the system first. Historically, the reality is that once a breach has occurred then all passwords for all users are vulnerable. Changing passwords and adding biometrics helps mitigate the individual user controlled vulnerability of passwords but, critically as passwords are still used to authenticate users ‘behind the scenes’ the vulnerability to ‘men-in-the-middle’ attacks still exists.
“Passwords, in one form or another, have existed as a means of security for a generation. And for most of their history, they’ve worked. But now that society has transitioned to digital combined with the regularity and sophistication of cyber attacks, security experts are now being required to put out fires all over the place, all while pleading with users to make their passwords more secure. The time is right to rethink the entire concept of the password,” concluded Worrall.
