No Password Is Too Complex For Hackers

Another huge data breach and another reason that the current password security system for business applications and websites is flawed. 

This time it was 412 million reasons, this being the number of accounts and user credentials that were exposed following the breach of FriendFinder Networks

According to LeakedSource, which acquired a copy of the leaked data set of the FriendFinder Networks breach, a million of the accounts have the password “123456” and more than 100,000 have the password, “password”. Despite people being continuously urged to be more diligent when it comes to password management, the issue is still being ignored and, in turn, breaches continue to happen.

Inconveniency of passwords

This is the latest in a long line of breaches that demonstrates the risks and consequences of using passwords as a means of authentication. Complex passwords are inconvenient, meaning users often avoid them in the first place or even store them or write them down elsewhere, offering more opportunity for them to be stolen. 

As a result, the password usability problem has worsened in recent years, so in order to maintain the stringent control necessary over the data that flows through organisation, IT leaders need to be adopting tools that address the major security issues at hand instead of continuing to operate under a system of increasing password adoption.   

It is shocking to see the number of people in the recent FriendFinder data breach that used the two most common passwords, ‘123456’ and ‘password’. 

Considering the number of data-breaches we have seen this year alone and the millions of people that have been affected (7 per cent of the global population reportedly affected in the Yahoo hack), even though a complex password is not going to stop the issue, picking the two most common and easily guessable passwords is absurd.    

However, it doesn’t matter what the password is, IT and security experts continue to advise on the importance of changing passwords, how often the password needs to be changed, and finally what constitutes a complex password. 

The common occurrence in all of the above solutions is that, the password. It doesn’t matter how many times a person changes or alters their password they still remain the issue. What’s needed is a change in mind-set towards security and to completely revise the entire concept of the password.  

Mass market for stolen data

Aggravating the issue even further is the fact that passwords sell for good money, meaning criminals have plenty of incentive to steal or crack them. 

Society has transitioned into digital and this has created a massive market for stolen data, subsequently sending security experts scrambling to put out fires, all the while pleading with users to make their passwords more secure, and never quite truly extinguishing the flames. 

Complex and hard to guess passwords alone are not enough as they still present risks, as it’s easier and less expensive than ever for cyber criminals to crack them. Even a standard desktop PC can try billions of password combinations every second, and password lists and password-cracking software is widely available.   

Passwords are fundamentally flawed, not only because they are often easy to guess and are easily hackable, but they are also expensive to maintain with between 20 and 50 per cent of help desk calls being for password resets according to Gartner. 

The New EU Data Protection Regulation comes into force in 2018, data breaches could lead to fines as high as €20m or up to 4 per cent – whichever is greater, of a company’s global turnover if there is a breach. 

The GDPR is a heavyweight piece of legislation that will require organisations across the board to put a stricter focus on the way they handle data. 

In light of this, the introduction of the GDPR should act as a wake-up call for organisations to take full control of their data and revaluate security systems that are no longer suitable, which, considering the number of data breaches we keep seeing, has to mean a upheaval of the traditional system.    

Passwords, in one form or another, have existed as a means of security for millennia. And for most of their history, they’ve worked as advertised. But as with all technology, it needs a refresh and this refresh is long overdue if you compare it to the speed of which everything else in this industry changes.

More secure pastures needed

In order to overcome the issues associated with passwords, organisations should look to other more secure pastures. Stop wasting time and money changing passwords, making them more complex and then suffering the inevitable embarrassment and potential huge fines after suffering a data breach. It’s time to disrupt the traditional concept of passwords as a means of authentication. We are all unique but a password is never unique. 

What’s needed is an approach that involves no passwords at all. By way of example, combining unhackable security tokens with the latest technologies means that no passwords are ever created, stored or transmitted.

ITProPortal:          Yahoo Hack Affects 1 Billion Accounts:
 

« What Happened To The Blockchain Revolution?
Online Con Tricks Senior Executives Out of Millions »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Nubo Software

Nubo Software

Nubo’s Virtual Mobile Infrastructure creates a virtual corporate device on your employee smartphones and tablets. Enable unlimited mobility without leaving any data at risk.

SecuGen

SecuGen

SecuGen is a leading provider of advanced, optical fingerprint recognition technology, products, tools and platforms for physical and information security.

RiskCentric

RiskCentric

RiskCentric is a consultancy specializing in risk management and compliance.

Cyber Security Specialists

Cyber Security Specialists

Cyber Security Specialists Limited provide Security services across a wide range of markets, from multi-national Corporate Organisations and Government Agencies, through to smaller Businesses.

Vintegris

Vintegris

Vintegris are a Certification Authority and manufacturer of innovative systems and applications for the full cycle of digital identity.

DataProtect

DataProtect

DataProtect is a specialized information security company providing consultancy, information management, integration and training services.

Pareteum

Pareteum

Pareteum is a leading Global provider of mobile networking software and services. Our mission is to provide a single solution to the problem of fully enabling and securing the Mobile Cloud.

CMMI Institute

CMMI Institute

CMMI Institute enables organizations to elevate and benchmark performance across a range of critical business capabilities, including product development, data management and cybersecurity.

Heidrick & Struggles International

Heidrick & Struggles International

Heidrick & Struggles is a premier provider of leadership consulting and senior-level executive search services for roles including Information & Technology Officers and Cybersecurity.

Industrial Control System Information Sharing and Analysis Center (ICS-ISAC)

Industrial Control System Information Sharing and Analysis Center (ICS-ISAC)

ICS-ISAC is a non-profit, public/private Knowledge Sharing Center established to help facilities develop situational awareness in support of local, national and international security.

Secura B.V.

Secura B.V.

Secura is an independent specialized cybersecurity expert, providing insights to protect valuable assets and data.

Pragma Strategy

Pragma Strategy

Pragma is a CREST approved global provider of cybersecurity solutions. We help organisations strengthen cyber resilience and safeguard valuable information assets with a pragmatic approach.

NetTech

NetTech

NetTech’s Managed CyberSecurity and Compliance/HIPAA services are designed to help your company prevent security breaches and quickly remediate events if they do happen to occur.

Kompleye

Kompleye

Kompleye is a recognized cybersecurity and compliance audit organization that offer a comprehensive solution for different industries.

Cyber Industrial Networks

Cyber Industrial Networks

Cyber Industrial Networks objective is to service the needs of industry in achieving reliable, robust and secure infrastructure that supports productivity.

Invictus International Consulting

Invictus International Consulting

Invictus International Consulting are a recognized leader in full-spectrum cyber technology solutions designed to protect the security of our nation's global defense and critical infrastructure.