Chris Meidinger, Technical Director, EMEA, Beyond Identity
Successful cyber attacks can often be complex in their entirety, but usually the origins are very simple or even trivial vulnerabilities. As the weakest link in the security chain, passwords have long been a favourite tool for cybercriminals: they can be easily guessed, cracked or otherwise obtained through social engineering tactics. The Verizon Data Breach Investigations Report and, more recently, the Crowdstrike Global Threat Report make it clear that criminals still use compromised credentials for initial entry in more than 75 per cent of all attacks.
The fact is that a “strong” password is wishful thinking. Complex passwords would be relevant if the attacker had to try to decrypt them. However, attacks are hardly ever perpetrated in this way. Cyber criminals prefer to grab passwords in readable form – from RAM, from keyboard input, unencrypted from databases, via phishing sites – wherever they are used and regardless of whether the password has four or 4,000 characters, contains three numbers or every special character. Considering how tedious it is for employees to remember passwords and change them regularly, it’s amazing that so many companies still try to protect their data with this outdated, insecure credential.
Every year we celebrate World Password Day while cybercriminals gleefully exploit password vulnerabilities. Instead, organisations should treat this day as “World No Password Day” and use it as an opportunity to close one of the biggest gateways in corporate security. By adopting passwordless, phishing-resistant MFA technologies, organisations can make it much more difficult for attackers to penetrate their networks – even with increased ease of use. Modern passwordless, phishing-resistant multi-factor authentication that combines biometrics and passkeys based on Fast Identity Online (FIDO) standards significantly reduces the risks associated with passwords and makes it virtually impossible for criminals to gain access to valuable corporate assets and sensitive data with their favourite tool.
