How Poor Password Hygiene Could Unravel Your Business

Passwords have been the keys to the kingdom for over 50 years, guarding the most sensitive data an organisation has. Yet despite their intrinsic value, they are one of the most overlooked forms of security, with more than 23 million people using ‘123456’ to protect their accounts.

More alarming is the fact that this year, ‘password’ was the most used phrase in the UK, according to NordPass. It is no wonder then that 90% of internet users are worried about their password being hacked. 

These statistic should be keeping business owners up at night, especially because 51% of users have the same passwords for work and personal accounts. The question is, where does the blame lie when a weak password leads to a breach? Is it down to the individual to take personal responsibility, or do we need to apply pressure on companies to introduce more robust authentication methods? In my opinion, the answer is all the above.

Why Passwords Are The Weakest Link

The average person has 100 passwords to remember. It is no surprise that many suffer from “password overload” due to the sheer number of online services and applications they use, both work-related and personal. Add in the need to generate complex passwords with characters and symbols, and the human brain will seek the path of least resistance, which often results in poor password practices. 

All it takes is for a single employee to have one account hacked, and a threat actor could potentially access every application they use, including professional collaboration tools such as Teams, Slack and Outlook. This could result in the leak of customer data, costly ransom demands or fines, or a complete loss of customer trust that can be difficult to regain. 

The impact of a breach could be even more harmful if it happens to someone with a higher level of permissions than other employees. In that case, cybercriminals could maneuver their way into the network almost unchallenged and create widespread damage.

If you are in an executive role, then it is especially important that you take proactive steps to combat password theft and credential exposure. Here are some of the ways you can strengthen password security protocols, and the actional steps that can be implemented for an immediate impact.

Remove Reliance On Passwords

Executives need to enact and enforce good cybersecurity practices. The best way to do that is to reduce the reliance you have on passwords alone. This means organisations need to adopt other authentication methods to reduce the chances of becoming overwhelmed. For example, by combining multiple account protection solutions such as two factor authentication apps with biometrics, you will lower the chances of a successful attack while at the same time, helping to improve the overall security posture in your organisation.

Businesses could also consider using Single Sign-On (SSO), which allows a user to authenticate themselves on multiple, separate platforms via a single ID. This solution negates the need for several different passwords. There is an element of risk, but by combining SSO with multi-factor authentication you can add a second layer of protection.

Other Ways To Make An Impact

Improving your password hygiene does not have to be complicated, but it does need to be implemented now to minimise the chances of an attack. There are actions that can be taken to help companies address the widespread problem of insecure passwords: 

Implement an account monitoring solution:   You can only protect what you can see, so it’s important that you have visibility of all accounts that have been compromised by an attack. Otherwise, how are you going to make improvements to stop an attack from happening again? This is why you need to review the default account settings and turn on features like locking an account after certain attempts. You don’t want an attacker to have unlimited time or an unlimited number of login attempts, allowing them to force their way into your organisation.

Protect against phishing attacks:   When asked about the impact of successful phishing attacks, 52% of security leaders said that they had experienced credential compromise. In light of this, what organisations should be asking themselves is ‘how did my email security allow this phishing email through?’ ‘Is it effective at blocking and preventing these carefully crafted emails?’ If not, then you need to invest in technology that will stop malicious emails from reaching the mailbox in the first place. The second step is to look for a solution that prevents a user from inputting their credentials into a phishing website. These solutions exist, it’s just a matter of investment and adoption.

Use a password manager:   Sometimes having a password is a mandatory requirement, so you cannot rely on other authentication methods alone. Conduct an evaluation to decide if a password manager would be appropriate for your organisation. Password managers have several benefits. They allow your employees to securely store credentials, generate unique passwords and they can auto-complete fields on websites. This removes the reliance on remembering hundreds of passwords or writing them down for anyone to see. 

The Takeaway

In the current cyber landscape, an attack is inevitable. However, preventing an attack is possible with the right combination of technologies and security protocols.

Put simply, action must be taken now to keep your accounts safe. Given that poor password hygiene and the resulting impact can damage an organisation’s reputation beyond repair, companies need to treat this situation with the level of seriousness it demands.

Muhammad Yahya Patel is a Security Engineer and member of the Office of the CTO at Check Point

You Might Also Read:

The Reality Check For Small & Medium Businesses:

 

« Guilty: A Criminal Conviction For One CISO Has Consequence For Others
Privileged & Protected - Managing Access At The Endpoint »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

TrustedSec

TrustedSec

TrustedSec is an information security consulting services, providing tailored solutions and services for small, mid, and large businesses.

Technology Association of Georgia (TAG)

Technology Association of Georgia (TAG)

TAG's mission is to educate, promote, influence and unite Georgia's technology community to stimulate and enhance Georgia's tech-based economy.

CERT-PA

CERT-PA

CERT-PA is the national Computer Emergency Response Team for Italian government institutions.

PSC

PSC

PSC is a leading PCI and PA DSS assessor and Approved Scanning Vendor.

Data Protection People

Data Protection People

Data Protection People are specialists in Data Privacy, Governance, and Information Security.

AlertEnterprise

AlertEnterprise

AlertEnterprise uniquely eliminates silos and uncovers blended threats across IT Security, Physical Access Controls and Industrial Control Systems.

Brookcourt Solutions

Brookcourt Solutions

Brookcourt Solutions delivers cyber security, network monitoring technologies and managed security services to help secure and protect your organisation’s critical infrastructure.

Cyber Defense Technologies (CDT)

Cyber Defense Technologies (CDT)

Cyber Defense Technologies provides services and turn-key solutions to secure and maintain the integrity of your organization’s systems and data against attacks.

Private Client Cyber Security (PCCS)

Private Client Cyber Security (PCCS)

PCCS provides enterprise-grade cybersecurity consulting and services to professional practices, executives, athletes, and high net worth families.

CoreStack

CoreStack

CoreStack helps enterprises overcome cloud challenges such as ever growing security risks, stringent regulatory compliance needs and operational complexities.

Verichains

Verichains

Verichains Lab is a pioneer and leading APAC blockchain security firm with extensive expertise in the areas of security, cryptography and core blockchain technology.

Commission Nationale de l'Informatique et des Libertés (CNIL)

Commission Nationale de l'Informatique et des Libertés (CNIL)

The mission of CNIL is to protect personal data, support innovation, and preserve individual liberties.

Blink Ops

Blink Ops

Blink helps security teams streamline everyday workflows and protect your organization better.

Cognna

Cognna

Cognna's innovative platform is designed to empower you and your team, providing the tools you need to detect, prevent, and resolve threats with ease.

Mindflow

Mindflow

Mindflow is dedicated to bringing answers to the challenges the cybersecurity field and beyond face today.

CyberUpgrade

CyberUpgrade

CyberUpgrade is on a mission to empower executives to gain control over their organization’s cybersecurity.