Are passwords the weakest link in helping to protect your business?

These statistics should be keeping business owners up at night, especially because 51% of users have the same passwords for work and personal accounts. The question is, where does the blame lie when a weak password leads to a breach?

Passwords have been the keys to the kingdom for over 50 years, guarding the most sensitive data an organization has. Yet despite their intrinsic value, they are one of the most overlooked forms of security, with more than 23 million people using ‘123456’ to protect their accounts. More alarming is the fact that this year, ‘password’ was the most used phrase in the UK and even here in India, according to NordPass. It is no wonder then that 90% of internet users are worried about their password being hacked, with as many as 62 of the most common passwords broken into in less than a second, in India.

This is extremely worrying given that according to Check Point Threat Intelligence Report, an organization in India is being attacked on average 1826 times per week in the last 6 months, compared to 1129 attacks per organization globally, with 80% of the malicious files in India delivered via Email in the last 30 days.

These statistics should be keeping business owners up at night, especially because 51% of users have the same passwords for work and personal accounts. The question is, where does the blame lie when a weak password leads to a breach? Is it down to the individual to take personal responsibility, or do we need to apply pressure on companies to introduce more robust authentication methods? In my opinion, the answer is all the above.

Why passwords are the weakest link

The average person has 100 passwords to remember. It is no surprise that many suffer from “password overload” due to the sheer number of online services and applications they use, both work-related and personal. Add in the need to generate complex passwords with characters and symbols, and the human brain will seek the path of least resistance, which often results in poor password practices.

All it takes is for a single employee to have one account hacked, and a threat actor could potentially access every application they use, including professional collaboration tools such as Teams, Slack and Outlook. This could result in the leak of customer data, costly ransom demands or fines, or a complete loss of customer trust that can be difficult to regain.

The impact of a breach could be even more harmful if it happens to someone with a higher level of permissions than other employees. In that case, cybercriminals could maneuver their way into the network almost unchallenged and create widespread damage.

If you are in an executive role, then it is especially important that you take proactive steps to combat password theft and credential exposure. Here are some of the ways you can strengthen password security protocols, and the actional steps that can be implemented for an immediate impact.  

Remove reliance on passwords

Executives need to enact and enforce good cybersecurity practices. The best way to do that is to reduce the reliance you have on passwords alone. This means organizations need to adopt other authentication methods to reduce the chances of becoming overwhelmed. For example, by combining multiple account protection solutions such as two factor authentication apps with biometrics, you will lower the chances of a successful attack while at the same time, helping to improve the overall security posture in your organization.  

Businesses could also consider using Single Sign-On (SSO), which allows a user to authenticate themselves on multiple, separate platforms via a single ID. This solution negates the need for several different passwords. There is an element of risk, but by combining SSO with multi-factor authentication you can add a second layer of protection.

Other ways to make an impact

Improving your password hygiene does not have to be complicated, but it does need to be implemented now to minimize the chances of an attack. There are actions that can be taken to help companies address the widespread problem of insecure passwords:

1- Implement an account monitoring solution: You can only protect what you can see, so it’s important that you have visibility of all accounts that have been compromised by an attack. Otherwise, how are you going to make improvements to stop an attack from happening again? This is why you need to review the default account settings and turn on features like locking an account after certain attempts. You don’t want an attacker to have unlimited time or an unlimited number of login attempts, allowing them to force their way into your organization.

2- Protect against phishing attacks:

When asked about the impact of successful phishing attacks, 52% of security leaders said that they had experienced credential compromise. In light of this, what organizations should be asking themselves is ‘how did my email security allow this phishing email through?’ ‘Is it effective at blocking and preventing these carefully crafted emails?’ If not, then you need to invest in technology that will stop malicious emails from reaching the mailbox in the first place. The second step is to look for a solution that prevents a user from inputting their credentials into a phishing website. These solutions exist, it’s just a matter of investment and adoption.

3- Use a password manager:

Sometimes having a password is a mandatory requirement, so you cannot rely on other authentication methods alone. Conduct an evaluation to decide if a password manager would be appropriate for your organization. Password managers have several benefits. They allow your employees to securely store credentials, generate unique passwords and they can auto-complete fields on websites. This removes the reliance on remembering hundreds of passwords or writing them down for anyone to see.  

The takeaway

In the current cyber landscape, an attack is inevitable. However, preventing an attack is possible with the right combination of technologies and security protocols. Put simply, action must be taken now to keep your accounts safe. Given that poor password hygiene and the resulting impact can damage an organization’s reputation beyond repair, companies need to treat this situation with the level of seriousness it demands.

Authored By: Harish Kumar GS, Head, Enterprise & Government, Check Point Software Technologies, India & SAARC