Passwords: The Weakest Link

By Nick Savvides, Business Manager, Information Protection, Symantec

Passwords; most of us depend on them to protect our information and more importantly, our online identities. But passwords may be the largest security liability of the internet. They put consumers, corporations and the wider online world at significant risk due to numerous weaknesses:

1. People. Most organisations allow users to create their own passwords and people tend to choose memorable passwords rather than secure passwords. 91 percent of all passwords used are found in the top 1000 most used passwords and more than 10 percent of PINs picked at random will be 1234.
2. Passwords are easily lost or stolen. Many people reuse the same password on multiple sites for convenience – creating a massive exposure for an individual’s entire online identity. Once a hacker has the password to one account, they can unlock a huge quantity of personal, financial and corporate information.
3. Recovery is flawed. If a user loses or forgets a password, the usual recovery method involves questions only they should know the answer to. Unfortunately the answers to these questions can often be found elsewhere online or can be stolen by hackers using social engineering methods.

Today’s IT departments are faced with the challenge of supporting the explosion of cloud-based apps and always connected devices, where many times the only thing between company data in the cloud and an attacker, is a password – and passwords alone are vulnerable, costly and complex.

For some time the answer to address these traditional authentication weaknesses appeared to be biometrics. But using biometrics for online security has rarely been seen outside Hollywood movies and consumers have been put off by high error rates and privacy concerns, while organisations find server-side biometric templates too risky to hold and as such, are prized targets for cybercriminals.

However the tipping point for biometric security is approaching and the technology is maturing. Over the next two years biometric security is predicted to meet end-user and organisational demands for both convenience and security and due to developments in the biometric security landscape, such as the rise of the smartphone, we can now combine multiple authentication factors in the security software space that are easy-to-use, but do not require the use of passwords.

Eliminating passwords improves the security and convenience of two-factor authentication and allows organisations to confidently embrace cloud and mobile with secure access from any device.

To hear more from Symantec, register to attend Data^#3’s JuiceIT 2016.