The news that more than 412 million accounts and user credentials were exposed following the breach of FriendFinder Networks should serve as a reminder to both organisations and individuals about the weaknesses of passwords. Gideon Wilkins, VP of Sales and Marketing at Secure Cloudlink, believes that due to the high incentive for cyber-criminals to steal this information, passwords as a form of authentication should be eliminated completely from the security equation.
According to LeakedSource, which acquired a copy of the leaked data set of the FriendFinder Networks breach, a million of the accounts have the password “123456” and more than 100,000 have the password “password”. Despite people being continuously urged to be more diligent when it comes to password management, the issue is still being ignored and, in turn, breaches continue to happen.
Wilkins commented: “This is the latest in a long line of breaches that demonstrates the risks and consequences of using passwords as a means of authentication. Complex passwords are inconvenient, meaning users often avoid them in the first place. As a result, the password usability problem has worsened in recent years, so in order to maintain the stringent control necessary over the data that flows through organisation, IT leaders need to be adopting tools that address the major security issues at hand instead of continuing to operate under a system of increasing password adoption. What’s needed is a change in mind-set towards security and to completely revise the entire concept of the password.
“Aggravating the issue even further is the fact that passwords sell for good money, meaning criminals have plenty of incentive to steal or crack them. Complex and hard to guess passwords alone are not enough as they still present risks as it’s easier and less expensive than ever for cyber criminals to crack passwords. Even a standard desktop PC can try billions of password combinations every second, and password lists and password-cracking software is widely available.
“In order to overcome the issues associated with passwords, organisations should look to other more secure pastures. It’s time to disrupt the traditional concept of passwords as a means of authentication. What’s needed is an approach that involves no passwords at all. By way of example, combining unhackable security tokens with the latest technologies means that no passwords are ever created, stored or transmitted,” concludes Wilkins.
