Passwords Will Get Hacked: Be Ready
May 5th of 2022 was celebrated as World Password Day. News stories were everywhere about how to improve password security, the best ways to implement multi-factor authentication, why a stronger password policy was needed, and what tools to use to better educate users. All represent vital actions and approaches. But they won’t be enough. According to a Google study, 24% of personal and professional accounts have used “password,” “Qwerty” or “123456” as their account password. “Admin” is another popular one. And, of course, people often use their date of birth, or that of their spouse, children, or grandchildren – all of these are easily hacked.
The same Google study found that only a third of users change their passwords frequently. Most of the rest hope to never have to change a password ever again. When forced to do so by adding yet more digits as well as capitals, numbers, and symbols, they often feel resentment. Instead of enhancing security, such security policies often have a contrary effect. Some users get even sloppier: Post-It note reminders in open view; and writing down passwords in a log, or in a document in a computer file.
Meanwhile, the bad guys have gotten smarter, faster, and more devious. They have password guessing algorithms that can crack soft passwords in no time at all. That’s why users are regularly prompted to add to more digits to their password. Six digits were once enough. Then eight. Now it is ten or more.
As the number of passwords increases and they become more and more complex, the current industry solution is to use a password management tool. But Google found that less than a third of people use them. Many don’t trust them as they have then no idea about any of their passwords should an emergency arise such as losing their phone or laptop. Thus, more than two-thirds of users continue to select passwords that are relatively easy to remember. Made to use ten digits, they often choose 1Password! to get around the latest security policy inconvenience.
Helpful tips are everywhere attempting to explain to users why they must change their habits. These tips all make sense: Don’t use sequential numbers or letters, avoid the use of your birth year/month/day; combine letters, numbers, and symbols and use unrelated words; avoid the names or words found in dictionaries; use a password manager, and don’t reuse passwords. Yet user habits are proving hard to break.
Password Breaches Are Inevitable
No matter the security policies set, the number of digits demanded, or the multiple authentication factors demanded, there is one sad, inconvenient, and inevitable truth. The bad guys are going to crack a password somewhere in the enterprise – or convince some gullible person to click on a malicious link or attachment. There is no avoiding this fact.
Despite that, organizations must continue to set good password and security policy, enforce it tirelessly, and add as many safeguards as they can to minimize the chances of password breaches. But they must understand, too, that a password somewhere or other will be hacked – and maybe it already has.
That’s why organizations must regularly scan the network and all devices for potential vulnerabilities. Vulnerability scanning is a proven way to prevent cyber security attacks. Scans will quickly detect any signs of a breach: where a password has been compromised, the back doors and ports re-configured by hackers, and any signs of data exfiltration attempts. IT can then prevent serious damage. By scanning authorization issues, security implementations, and antivirus status, vulnerability scans offer insights into any misconfigurations or compliance violations that may be present. By addressing these rapidly, the organization greatly reduces its attack surface and minimizes the chances of a breach.
The Syxsense vulnerability scanner is not only a complete security management package, but it is also effortless to employ with a user-friendly interface. As it is automated, that allows IT to focus on priority tasks while it scans and secures the system. Decide how often and for how long it should run, and the scanner runs monitors and secures the entire network at the pre-determined frequency and time. It also is available in an automated and integrated suite that includes patch management, mobile device management, and IT management.
For more information:
