The Cyber Defense eMagazine November Edition for 2023

The issue with passwords
Passwords usually aggravate users due to all the associated friction. Nobody likes memorizing long
strands of letters, numerals, and symbols to conduct the simplest business, but weak passwords tend to
reward bad actors, which is of course the underlying problem. The goal of passwordless is about reducing
the amount of friction to make authentication and authorization simpler for users. So, in essence, we
should think of “passwordless” as being “frictionless,” based on simplifying the login process for users.
The trouble is, the safest passwords are typically the hardest to remember, so there is a high amount of
friction. But in a world where hackers launch an average of 50 million attacks on passwords every day,
which equates to 579 strikes per second, according to Microsoft, safety should override convenience, but
that often isn’t the case. In fact, Verizon found that 60% of data breaches are now attributed to
compromised credentials. Hackers often prey on a user’s natural proclivity for convenience when people
re-use the same ID and password combination for multiple sites. Once those passwords and IDs appear
on the dark web, they can be used for a range of different logins.
Surviving in the present
In the short term, we need to bridge the gap between the needs for a strong, complex password – with
the reduction of friction for employees. Nearly half of all Americans (41%) still rely on memory to recall
their passwords, meaning that they often adopt simple or repeatable words that are easy to remember.
There is an easy solution which both reduces friction and improves security: password managers.
Organizations taking security seriously can offer employees a subscription to a password manager which
eliminates the need for employees to remember complex passwords while still providing sufficiently
robust credentials. Additionally, organizations should consider using tools which regularly check if
passwords are compromised, further ensuring the strength of the passwords used.
Passwords aren’t enough on their own however, and need to be bolstered by some of the “passwordless”
security protocols that we have been using for years. Multifactor authentication (MFA) is an age-old
concept that relies on something you have (a device or application) plus something you know (a captcha
or existing account) to prove your unique identity and authorize your access. Two-factor authentication
(2FA) was the first widespread adoption of this method, in which exactly two authentication factors were
required, but with the threats becoming more sophisticated the industry has been shifting towards
requiring more than two factors to better safeguard against attack like credential stuffing. These helps
make the organizations more secure, but also add friction which a passwordless future promises to
eliminate.
The road to forgetting our passwords forever
We have seen many of the biggest tech companies like Apple, Google, and Microsoft lead the charge
into a passwordless future with the use of biometric recognition or facial recognition. These approaches
can be an effective alternative to passwords as it is much harder to fake someone’s fingerprints or face
Cyber Defense eMagazine – November 2023 Edition 120
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.