Companies need to secure employee accounts from the start and have an ongoing ability to check password security.
Security hygiene is an increasingly important factor in today’s heightened threat environment when companies are vetting technology providers, MSPs and others in the channel. These groups are investing significant sums of money to strengthen security to protect their data and their clients, yet there is a critical area that is often overlooked: password reuse and the sharing of passwords between personal and work accounts.
The average person knows better than to reuse passwords across multiple work and personal related sites, but the human desire for convenience and efficiency will trump this knowledge every time. For example, 91% of respondents in a LogMeIn survey claim to understand the risks of reusing passwords across multiple accounts, but 59% admitted to doing it anyway. What’s more, 62% of employees are reusing the same password for both work and personal accounts.
|You can learn more about the threats posed by reusing passwords in this gallery from Channel Partners.|
There is a staggering amount of breach data on the internet and Dark Web and with attacks occurring on a continuous basis, this treasure trove for hackers is only growing. I recently spoke with a company that discovered that 4% of its uncompromised credentials become compromised within one month and this happened month over month. All a cybercriminal needs to do is obtain an exposed credential from one breach and use those same credentials to access other sites and systems. With the rampant practice of password reuse, it won’t be long before the hacker is able to access sensitive accounts and information.
For channel partners, this practice represents a serious security vulnerability. MSPs have emerged as a top target for hackers, with the U.S. Department of Homeland Security’s Computer Emergency Readiness Team (US-CERT), issuing an alert warning companies of advanced persistent threat activity. In addition to the typical headaches associated with data breaches — financial repercussions, brand impact, loss of sensitive data — MSPs and other groups in the channel face the added pressure of fallout from the client and vendor community. For many, this pressure will be too much to withstand — one study found that 60% of small businesses fold within six months of experiencing a breach.
Organizations have historically addressed compromised passwords by implementing mandatory password resets every 42 to 90 days following the recommendations of traditional guidelines. However, times have changed as both the National Institute of Standards and Technology (NIST) and Microsoft have recently come out against password expiration for a number of reasons:
With awareness growing of these and other issues associated with expiring passwords, organizations must now focus on securing employee accounts from the start. Many companies in the channel have high employee turnover, and it’s important to be conscious of poor password practices that might follow your new hire from their prior position. Researchers from Virginia Tech University found that more than 70% of users employed a compromised password for other accounts up to a year after it was initially leaked, with 40% reusing passwords which were leaked over three years ago. This underscores that companies must expect poor password hygiene from their users and revise password policies accordingly.
NIST recommends that companies now verify …
BUSTING MYTHS AND IDENTIFYING LEADS: How to give your sales a boost
Dell Technologies’ Project Apex Solidifies as-a-Service and Cloud Strategy
Solve the Cybersecurity People Problem with Security Awareness Training
How MSSPs Can Fulfill Organizations’ Needs for Proactive, Human-Led Threat Hunting
Virtual Splunk conf20: Thriving in the Data Age Amid COVID-19
New Sungard AS Private Cloud Rounds Out Vendor’s Connected Cloud Ecosystem
‘Great Companies Are Built in Tough Times’: How Partners Are Thriving in 2020
The Path to Business Transformation
Please log in again. The login page will open in a new tab. After logging in you can close it and return to this page.