How Poor Password Hygiene Could Unravel Your Business

Passwords have been the keys to the kingdom for over 50 years, guarding the most sensitive data an organisation has. Yet despite their intrinsic value, they are one of the most overlooked forms of security, with more than 23 million people using ‘123456’ to protect their accounts.

More alarming is the fact that this year, ‘password’ was the most used phrase in the UK, according to NordPass. It is no wonder then that 90% of internet users are worried about their password being hacked. 

These statistic should be keeping business owners up at night, especially because 51% of users have the same passwords for work and personal accounts. The question is, where does the blame lie when a weak password leads to a breach? Is it down to the individual to take personal responsibility, or do we need to apply pressure on companies to introduce more robust authentication methods? In my opinion, the answer is all the above.

Why Passwords Are The Weakest Link

The average person has 100 passwords to remember. It is no surprise that many suffer from “password overload” due to the sheer number of online services and applications they use, both work-related and personal. Add in the need to generate complex passwords with characters and symbols, and the human brain will seek the path of least resistance, which often results in poor password practices. 

All it takes is for a single employee to have one account hacked, and a threat actor could potentially access every application they use, including professional collaboration tools such as Teams, Slack and Outlook. This could result in the leak of customer data, costly ransom demands or fines, or a complete loss of customer trust that can be difficult to regain. 

The impact of a breach could be even more harmful if it happens to someone with a higher level of permissions than other employees. In that case, cybercriminals could maneuver their way into the network almost unchallenged and create widespread damage.

If you are in an executive role, then it is especially important that you take proactive steps to combat password theft and credential exposure. Here are some of the ways you can strengthen password security protocols, and the actional steps that can be implemented for an immediate impact.

Remove Reliance On Passwords

Executives need to enact and enforce good cybersecurity practices. The best way to do that is to reduce the reliance you have on passwords alone. This means organisations need to adopt other authentication methods to reduce the chances of becoming overwhelmed. For example, by combining multiple account protection solutions such as two factor authentication apps with biometrics, you will lower the chances of a successful attack while at the same time, helping to improve the overall security posture in your organisation.

Businesses could also consider using Single Sign-On (SSO), which allows a user to authenticate themselves on multiple, separate platforms via a single ID. This solution negates the need for several different passwords. There is an element of risk, but by combining SSO with multi-factor authentication you can add a second layer of protection.

Other Ways To Make An Impact

Improving your password hygiene does not have to be complicated, but it does need to be implemented now to minimise the chances of an attack. There are actions that can be taken to help companies address the widespread problem of insecure passwords: 

Implement an account monitoring solution:   You can only protect what you can see, so it’s important that you have visibility of all accounts that have been compromised by an attack. Otherwise, how are you going to make improvements to stop an attack from happening again? This is why you need to review the default account settings and turn on features like locking an account after certain attempts. You don’t want an attacker to have unlimited time or an unlimited number of login attempts, allowing them to force their way into your organisation.

Protect against phishing attacks:   When asked about the impact of successful phishing attacks, 52% of security leaders said that they had experienced credential compromise. In light of this, what organisations should be asking themselves is ‘how did my email security allow this phishing email through?’ ‘Is it effective at blocking and preventing these carefully crafted emails?’ If not, then you need to invest in technology that will stop malicious emails from reaching the mailbox in the first place. The second step is to look for a solution that prevents a user from inputting their credentials into a phishing website. These solutions exist, it’s just a matter of investment and adoption.

Use a password manager:   Sometimes having a password is a mandatory requirement, so you cannot rely on other authentication methods alone. Conduct an evaluation to decide if a password manager would be appropriate for your organisation. Password managers have several benefits. They allow your employees to securely store credentials, generate unique passwords and they can auto-complete fields on websites. This removes the reliance on remembering hundreds of passwords or writing them down for anyone to see. 

The Takeaway

In the current cyber landscape, an attack is inevitable. However, preventing an attack is possible with the right combination of technologies and security protocols.

Put simply, action must be taken now to keep your accounts safe. Given that poor password hygiene and the resulting impact can damage an organisation’s reputation beyond repair, companies need to treat this situation with the level of seriousness it demands.

Muhammad Yahya Patel is a Security Engineer and member of the Office of the CTO at Check Point

You Might Also Read:

The Reality Check For Small & Medium Businesses:

 

« Guilty: A Criminal Conviction For One CISO Has Consequence For Others
Privileged & Protected - Managing Access At The Endpoint »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

aizoOn Technology Consulting

aizoOn Technology Consulting

aizoOn is a technology consulting company offering a range of services including IoT & embedded security, mobile security, cybersecurity assessments, risk & compliance, network monitoring and more.

Flexera

Flexera

Flexera is reimagining the way software is bought, sold, managed and secured.

Cyber Security Expo

Cyber Security Expo

Cyber Security EXPO is a unique one day recruitment event for the cyber security industry.

spriteCloud

spriteCloud

spriteCloud is an independent software testing, test automation and cybersecurity services provider.

LibraSoft

LibraSoft

Librasoft creates solutions to protect information from external and internal threats.

SideChannel

SideChannel

At SideChannel, we match companies with an expert virtual CISO (vCISO), so your organization can assess cyber risk and ensure cybersecurity compliance.

CertiProf

CertiProf

CertiProf has been enhancing professional lives since 2015, offering a wide range of IT certifications and agile framework training.

Execweb

Execweb

Execweb are a cybersecurity executive network, comprised of 400+ security practitioners who work at Fortune 500 and SME companies.

Probity

Probity

Probity Inc. is a certified software development and systems engineering company, providing support to federal government and national defense related clients.

CyberHub

CyberHub

CyberHub is an educational platform that offers professional courses and knowledge sharing through articles and videos to help students discover their potential in cybersecurity.

Jot Digital

Jot Digital

Jot Digital is a full-service technology company specializing in digital engineering, application modernization and business transformation.

ThreatDown

ThreatDown

ThreatDown, powered by Malwarebytes, is on a mission to overpower threats and empower IT by removing the complexity of detecting and stopping today’s most advanced threats.

White Knight Labs

White Knight Labs

White Knight Labs is a cyber security consultancy that specializes in cybersecurity training.

Black Duck Software

Black Duck Software

Black Duck (formerly the Synopsys Software Integrity Group) is the market leader in application security testing (AST).

Simpson Associates

Simpson Associates

Simpson Associates is a Data Transformation and managed services provider that helps organisations gain valuable insights from their data and make better-informed decisions.

Atumcell

Atumcell

Atumcell’s targeted risk assessment exposes emerging threats before they cause harm.