Passwords: Lock, set, and secure!

Dubai - Good password hygiene and high levels of awareness of different cyberattack types are proven methods for reducing the risk of an attack and protecting organisations and their employees

Often times, the only thing standing between you and ruinous financial consequences is a strong password, security experts say.

With how hectic our daily lives have become, it is hard to spare more than a thought for something that is not considered to be a task in need of immediate attention – sadly, passwords seem to fall into this category. World Password Day, though, would beg us all to reconsider.

Maher Jadallah, regional director - Middle East, Tenable, explains that World Password Day, which falls every year on the first Thursday in May, is an initiative to encourage individuals to create and use strong passwords.

“Practically everything we do in both our personal and professional lives involves an online identity,” he said. “Whether it is accessing corporate networks, utilising electronic communication and messaging services, sharing video clips with our friends and family via social sites, all require some form of identity verification for access that typically takes the form of a username and password combination.”

The issue, he says, is that vast databases containing these combinations are available on the dark web. Every time one site is breached and this information exposed, attackers will try these against other virtual locks to see if they will open more than just the compromised account. Unique password and username combinations will prevent credential stuffing, but this creates another challenge.

“When you think about the number of online accounts any person has, this can quickly mount up to be in the hundreds,” Jadallah said. “Password managers can help, allowing users to have numerous password combinations, while ensuring all these ‘keys’ are stored and accessible, but isn't this just delaying the inevitable. While strong passwords are beneficial, organisations could be doing more to implement stringent security verification; multifactor authentication, one time passcodes, and biometrics such as fingerprint, iris scan, and facial recognition all provides a much stronger lock to keep attackers out.”

Avinash Gujje, practice head – Infrastructure, Cloud Box Technologies, agrees and said that traditional passwords will never become extinct, however, the mode of the password usage will definitely change. “Today, in any IT environment, the end user password has rapidly changed into face recognition, touch based or multi-factor authentication, however the core systems still depend on traditional passwords policy due to the system dependencies.”

Duane Nicol, a cybersecurity expert at Mimecast, says that cybercriminals are capitalising on poor password hygiene and a lack of cybersecurity awareness from end users to bypass an organisation’s defences – with potentially ruinous consequences. He also noted that the Covid-19 pandemic and switch to remote work created new vulnerabilities that cybercriminals are working hard to exploit. In response, organisations should build greater cyber resilience by implementing updated security controls and prioritising regular cybersecurity awareness training to protect employees, and the business, from attacks.

rohma@khaleejtimes.com