In the end, what makes implementing a successful secure password management strategy is actually having a strategy in the first place insists Kevin Bocek, director at IronKey. "While it may seem simple" Bocek tells us "it's most important to have a password management strategy and policy of some sort that's actually implemented and enforced even though it's not perfect".
At the smaller end of the enterprise scale, this is often still not yet accomplished. But with the Information Commissioner's Office placing the spotlight on data breaches, many organisations of all sizes have started encrypting mobile data.
"Without being able to enforce and report on encryption use, including the type and quality of passwords used for unlocking encryption keys" Bocek warns "escaping a fine that can reach 500,000 could provide difficult".
Which is where a Continuous Controls Monitoring (CCM) solution can be useful, suggests Richard Hunt.
"CCM provides users with real-time status assurances for all of their compliance control points" he explains "a rule can be configured that triggers an automatic and regular review of password complexity to ensure that user passwords contain enough variation in terms of numbers and upper and lowercase letters". Any exceptions will be automatically flagged in the control output and then reviewed by the IT Admin for relevant action.
Secure or not secure?
So what makes a truly secure password? Jason Hart, an ex-ethical hacker and now vice president of security at CRYPTOCard has a very straight response to the question: nothing makes a password truly secure!
"Passwords are the softest security target" Hart warns "and until people and organisations start adopting strong authentication in the form of, for instance, two-factor authentication this problem won't go away".
Sadly, of course, he is right. Which is why many enterprises are now combining something you have (such as a smartcard or USB stick with a one time password function) with something you know (a PIN) to secure their networks instead.
-
Enterprises face delicate balancing act with data center sustainability goalsNews High energy consumption, raw material requirements, and physical space constraints are holding back data center sustainability efforts, according to new research from Seagate.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
I love magic links – why aren’t more services using them?Opinion Using magic links instead of passwords is safe and easy but they’re still infuriatingly underused by businesses
-
Password management startup Passbolt secures $8 million to shake up credential securityNews Password management startup Passbolt has secured $8 million in funding as part of a Series A investment round.
-
LastPass breach comes back to haunt users as hackers steal $12 million in cryptocurrencyNews The hackers behind the LastPass breach are on a rampage two years after their initial attack
-
GitHub launches passkeys beta for passwordless authenticationNews Users can now opt-in to using passkeys, replacing their password and 2FA method
-
Microsoft SQL password-guessing attacks rising as hackers pivot from OneNote vectorsNews Database admins are advised to enforce better controls as attacks ending in ransomware are being observed
-
No, Microsoft SharePoint isn’t cracking users’ passwordsNews The discovery sparked concerns over potentially invasive antivirus scanning practices by Microsoft
-
Microsoft Authenticator mandates number matching to counter MFA fatigue attacksNews The added layer of complexity aims to keep social engineering at bay
-
As Google launches passwordless authentication for all, what are the business benefits of passkeys?News Google follows Apple in its latest shift to passwordless authentication, but what are the benefits?
