Obituary: But is the Humble Password Really Dead?

The humble password must have read its obituary many times in recent years, given the number of “Pa” swords are dead” titles that have been published. At a Gartner conference, I recently saw the headline “Wa” king dead – the password.” But is it dead? A recent article posted by SecurityWeek stated that the number of passwords will grow to 300 billion by 2020. This seems to contradict the reports of the demise of the password. So, as the number of passwords seemingly continues to increase, why don’t we recognize this and do our best to help the password survive into the future as a vital companion for guarding the doors to our online presence?

Password – you-you’re! It’s not OK, like in perfect. You have your deficiencies and challenges, but you certainly have strengths and benefits, which should kick that obituary out to a far-away future!

But why do so many experts want passwords to die and disappear? Is it because of the risk that users are unaware of how to protect their passwords and then share them too freely with others? Or because other alternatives exist? Though these alternatives may be handy, even these carry a cost and could be misused by determined high-tech criminals. Some security experts even claim that regardless of the credentials of any system, it is only a question of time before it is breached.

On the other hand, it’it’sso worth remembering that passwords dondon’tst anything, they are instantly available, they can easily be replaced if forgotten, and all types of systems accept them as credentials.

As stated above, all credentials possess risks. Multi-factor authentication should always be used for the “most important” s” stems, users, and situations. But here, using passwords is the perfect companion to other credentials for each user. The traditional categorization of creating good authentication credentials still makes good sense:

With multi-factor authentication, we combine credentials from these different categories. It is challenging for any criminal hacker to breach them all. It is hard to understand why the first category: “So” thing only I know” =”passwords, should be excluded from the authentication process.

So clearly, passwords are not dead yet. The question is, will it ever be a good idea to kill them off? Those who want to kill the use of passwords should first present a viable alternative and justify that the alternative is better than the use of passwords.

Meanwhile, password guardians must take extra steps to secure them better. This means improving the processes while reducing the cost of password systems (such as assisting users with forgotten and locked passwords). This is easier and cheaper than throwing passwords away and embarking on new methods that might be a wrong choice in the long term. One great example of such a method is the SMS one-time-password (OTP), which was seen as the natural replacement of passwords a few years ago. However, today, this method is considered riskier than passwords.

Here are some tips on addressing password risks and turning them into strengths.

(For Windows/AD passwords and other corporate applications, like SAP, Oracle, and IBM)

The challenge: To reduce the password-related costs to your business

We all can indeed create as many passwords as we need. We didn’t want to buy anything to create a password! Any PC or smartphone will accept a password without the need to buy an extra device or to deploy special software.

However, users often forget or lock their passwords, and they need assistance—and this assistance comes at a cost.

The comeback:

To mitigate this cost, users should be given a self-service portal to reset passwords—even from their locked PC! This will minimize the cost of retrieving or resetting passwords.

The challenge: Users give passwords away— victims to phishing

Hackers often try to get users to provide them with their passwords through phishing attacks successfully.

The comeback:

Software solutions exist to help you fight phishing attacks. These solutions should be combined with end-user awareness training. Password expiration prevents hackers from continuing to use the password they share with the real end-user (i.e., the original password owner).

The challenge: Hackers may guess passwords

Have you ever heard of some popular passwords? Hackers try many popular passwords to see if they can open an account. Unfortunately, some users reuse their corporate passwords for other private web applications. When the other system is hacked, this can help hackers if the breached password is identical to the one the end-user uses in the corporate world.

The comeback:

Have you ever heard of some popular passwords? Hackers try many popular passwords to see if they can open an account. Unfortunately, some users reuse their corporate passwords for other private web applications. When the other system is hacked, this can help hackers if the breached password is identical to the one the end-user uses in the corporate world.

The challenge: Hackers use social engineering

As the well-known white-hat hacker Kevin Mitnick says: “Wh” spend hours trying to guess a password when you can get it by using your phone!” H” stickers will call the service desk and impersonate a genuine user and try to get the service desk to reset and get the useuser’sssword. They will often be successful.

The comeback:

The mitigation is to implement clear processes for service desks assisting users with password resets and qualified user verification. This should involve a high-quality IT workflow using dynamic and contextual data, including manager approval for the more important users.

Self-Service Password Reset

Automation tool to reduce service desk cost and improve user experience and productivity. For Windows, SAP, Oracle, IBM and more.

Get Free Demo

Book a Free Demo with our specialist to learn more about FastPass Password Self Service Reset with 90% User Adoption