Example essay

GUEST ESSAY: Why it’s wise to automate distributing strong passwords to employees

Passwords have become ubiquitous with digital. Yet most people don’t know how to use them properly. The humble password is nothing more than a digital key that opens a door.

Related: The advent of passwordless access

People use keys to open their house, office, garage or car. And they use passwords to open a device, system, account, file, etc.

But the similarities end there. In the physical world, people don’t have to create their own keys; the keys are given to them by a landlord, locksmith or employer. Whereas in the digital world, people are required to create their own passwords, which they then have to remember and type in every time.

Which begs the question: why do people create their own passwords? In truth, they don’t need it. Just like they don’t need to hammer their own keys. They just have to receive them, collect them and use them.

Cybersecurity blind spot

This misunderstanding has real implications for businesses as it takes away their ability to be cyber secure. The moment companies let their employees create their own passwords, they are transferring command and control of their network, financial risks and responsibilities to their employees.

They also create a huge cybersecurity “blind spot” and potential attack surface because they don’t know if and when passwords are shared, stolen, or phished. Finally, since the human brain cannot create and remember many complex and unique passwords, it puts its employees in check, because people keep using passwords like 123456, the same password or a pattern of password they can remember.

O’Toole

This explains why over 80% of data breaches start with weak, reused and stolen passwords through password phishing, social engineering, brute force attacks and credential stuffing. Hackers don’t need to hack, they just log on.

With more victims, they harvest more identifying information, which leads to more victims. After the Covid-19 pandemic pushed people to work from home, this cyber pandemic only got worse, allowing more and more ransomware attacks.

Automated distribution

Just as employees don’t bring their own keys to the office, they shouldn’t bring their own passwords to the digital office. A much better way is to incorporate innovative technology that distributes unique, encrypted passwords to employees that only they can use to access each separate device, account, file, or system.

Useful, this innovative solution is easy to implement and does not require any change in infrastructure. It relieves employees of the burden of creating, remembering and entering passwords.

And unlike single access solutions, where hackers only need one key to gain access and take everything, it segments each access so that each password only opens one door, ensuring cyber resilience and cyber security. If a password is stolen, for example during a supply chain attack, only one system is infected and, by default, contained, while the other systems remain safe.

Segment Access

This segmented access system completely removes the concept of identity or trust from access. Just like your door doesn’t need to recognize your identity when you come home: if you have the key, you can enter; otherwise, you can’t, no matter who you are.

When a new employee starts a new job, they receive encrypted passwords, stored in a digital fortress that only that user can access after several layers of security. Each system has a different password that the user can click on to open a system, without ever seeing what the password is, just like when using a key fob or card to open a door.

The system also allows businesses to see who has accessed their passwords, similar to a building access monitoring system, which further helps track access in the event of a breach.

When people leave a company or department, companies can instantly remove their passwords. Moreover, since they have never known their passwords, they cannot store or pass them on. Exactly the same way employees hand over their keys, badges and cards to access the company building, elevators or offices when they leave. This removes the risk of unauthorized access through old accounts when people leave.

An encrypted password distribution system not only allows businesses to regain control of their own access, it also removes the need to invest in training employees in password hygiene, a daunting task for the mastermind that was never intended to be made in the first place. Free up their time to invest in more productive work.

This approach not only simplifies the life of employees (since there are no more passwords to know, therefore no more password resets), it also eliminates all the security risks and costs associated with human behavior and the huge problems associated with stolen, phished or shared passwords. .

Finally, this type of zero-trust system is completely scalable, as you can make keys more and more complex. To resist future threats from quantum computing, businesses can easily use billion-character passwords because it’s just a string that no one needs to see.

About the essayist: Julia O’Toole is the Founder and CEO, MyCena Security Solutionsproviding a mobile app that turns your smart device into a portable digital safe.

*** This is a syndicated blog from the Security Bloggers Network of The Last Watchdog written by bacohido. Read the original post at: https://www.lastwatchdog.com/guest-essay-why-automating-distribution-of-strong-passwords-to-employees-is-wise-to-do/


Source link