Password Management in a New Era of Remote Working

By

2020 was a year of tremendous chaos and stress on many levels and stretched the limits of IT teams who were responsible for securing corporate assets, as entire companies sent employees home to work, including those same IT teams. A new generation of IT heroes was born, and CIOs, CISOs, and IT analysts and managers stepped up to address uncommon challenges, even as cyberattacks grew to all-time highs.

Among the many puzzles to be solved were password policies, monitoring, management, and – above all – automation. As the Verizon DBIR reported last year, most cyber breaches happened due to mismanaged passwords, either shared, easily compromised, or stolen. Whether accidentally or intentionally leveraged, individuals continued to be at fault for most hacks, whether full or part-time employees, or consultant and contractors, or even third-party vendors with access to critical infrastructure.

Something as simple as maintaining a complex password could go a long way, but doing so can be anything but simple as the dispersion of the workforce threw a wrench into the more stable environment where most employees were within the physical perimeter of workplaces.

Nearly every worker is aware that weak passwords (like 12345 or ABCDE) are not secure, even as consumers are now prompted to use passwords with certain combinations of upper case, lower case, numbers, and symbols and are increasingly opting in to allow the platforms for services they subscribe to, to automatically generate and store complex passwords in a personal vault.

It goes without saying that every organization should go beyond requiring the use of strong passwords on all devices, whether company-owned or not. The best cybersecurity systems are virtually useless if remote users use weak passwords.

We asked Michael Fritzlo, Executive Chairman of Ironsphere, a privileged access management software company, what they recommend as we embark on a new year, where few doubt the workplace will ever return to what we used to consider “normal.”

“The strongest passwords are long and random, contain a mix of alpha, numeric, and special characters, have both upper- and lower-case letters, and are essentially impossible to guess,” Fritzlo said. “Strong passwords are also changed frequently to ensure that if the password were to become compromised, it would be replaced immediately, which is where password vault automation comes in.”

In addition to remote working security basics (for example, security software on all devices, continual updates to operating systems to address new vulnerabilities, the use of a Virtual Private Network with data encryption, a minimum of two-factor authentication and preferably multi-factor authentication, and clear policies and guidelines on sharing and saving information) Michael Fritzlo indicated “Advanced software-based approaches and cybersecurity automation enable organizations to protect themselves from one of the primary causes of breaches – adversaries taking control of privileged accounts by being able to “crack the code” on privileged users’ passwords.”

“Rather than trusting privileged users to set up and remember passwords, modern approaches automate this process, where users’ credentials are securely stored within a vault where access is determined by Role-Based Access Controls, and passwords are encrypted with algorithms. Advanced Password Vaults update passwords across the entire IT infrastructure, ensuring the protection of networks, servers, applications, and data. For comprehensive coverage, automated systems can also secure end-point devices from being compromised, even if credentials are lost, shared, or stolen.”

While a variety of solutions are available in the market today, and hundreds of thousands of organizations, from small to medium businesses to government agencies and educational institutions, have certain policies and authentication capabilities in place, Fritzlo said given the growth and sophistication of attacks, an advanced password vault posture is critical.

“A systematic approach is key; this is not something that should be done half-way. IT leaders should ensure that their password vault manager will be able to work with all relevant systems, including remote desktops, virtual desktops, web and browser-based applications, across all mobile devices including smartphones and laptops,” Michael Fritzlo said. “The installation and configuration should be easy or invisible to end-users, and auto-discovery should be included to minimize work time and mistakes.”

Fritzlo also said filtering, alerting, reporting, analytics, and cost should be part of the evolution of password automation and pointed out the relationship to data governance and risk.

For example, does the solution interoperate with third-party vendor products (web servers, app servers, routers, and other networking equipment?

Does the solution work seamlessly with ITSM solutions for change management and governance control?

Is 100% keylogging and recording included to support compliance and audit requirements?

“With the right password vault technology, organizations prevent unauthorized access to critical systems and stop attacks using stolen privileged credentials,” Fritzlo concluded. “Imagine the difference when more organizations use this technology to prevent adversaries from breaking into their infrastructure; while cybercriminals are increasingly sophisticated, they will have to work harder, and they will learn that even if they attempt to circumvent systems, the systems are recording their every keystroke, which will enable law enforcement to track down intruders, making the investment in stealing information or taking control of assets less attractive.”




Edited by Maurice Nagle

Content Contributor

SHARE THIS ARTICLE
Related Articles

Google's Flutter 2.0 Now Directly Supports Web/Desktop Apps

By: Luke Bellos    3/5/2021

Google has unveiled the latest version of Flutter, now supports web and desktop applications.

Read More

How to Optimize Google Shopping Ads Campaigns in 2021

By: Special Guest    3/4/2021

Each day millions of people use Google to find products that they want to buy. Google Shopping Ads put your products in front of the right people at t…

Read More

IKIN Embraces Open Ecosystem with B2B Opportunity in Crosshairs

By: Maurice Nagle    3/4/2021

Science fiction and fantasy films offered a glimpse of what holographic technology, from Princess Leia's plea for help, to Tony Stark delivering parti…

Read More

What the Dark Web Actually is And Why People Use it

By: Special Guest    3/4/2021

Ever since the internet's inception in the '80s, there have been many game-changing developments and innovations. Among these, some of the most exciti…

Read More

The modern approach to document management workflow

By: Special Guest    3/3/2021

Handling massive amounts of documents remains one of the key challenges faced by every company and organization on the market. Fortunately, the develo…

Read More