SecurityWise: Password strategies that can help your business remain secure
27 Jun 2022
As a business owner or system owner, you may not always be directly responsible for the authentication methods used within third-party services your organisation relies upon. So, it’s worth taking some guidance which can help you to understand the risks and benefits and then inform your selection of one that best meets your business and security needs when selecting services.
In the past, many predicted the death of the password and felt alternative authentication methods would be adopted to control access to IT infrastructure, data, and services. More recently, password use has risen, and they remain the default method of authentication for a wide range of services, both at work and home.
How are passwords discovered?
The prevalence of continued password uses, and increasingly complex password requirements places a potentially unrealistic demand on users who simply will devise their own coping strategies to cope with continued password demands. Users will decide to re-use the same password across different services and systems using basic and extremely predictable password creation strategies, or just writing passwords down where they can be easily found.
Cyber attackers will use a variety of techniques to discover passwords, especially well-known coping strategies, usually exploiting a range of social and technical vulnerabilities. These techniques are easily accessible and documented on the internet.
These can include:
- ‘Shoulder surfing’ (where they observe someone typing in their password)
- Tricking someone into revealing their password via social engineering (including phishing and coercion)
- Finding passwords which have been stored insecurely, such as sticky notes kept close to a device, or documents stored on devices
- Manual password guessing (such as name, date of birth, or pet names)
- Using the passwords leaked from data breaches to attack other systems where users have used the same password
- Password spraying (using a small number of commonly used passwords to access many accounts)
- Installing a keylogger to intercept passwords when they are entered into a device
What can I do?
Passwords will always have a limited ability to protect your data and systems compared to newer authentication methods and therefore are severely limited in helping prevent unauthorised access. If an experienced attacker discovers or guesses the password, then they can impersonate a user.
There's still lots you can do to make sure your password policy is as effective as possible and part of your wider approach to authentication. The six tips, according to the National Cyber Security Centre are:
1. Reduce your organisation's reliance on passwords
- Use multi-factor authentication (MFA) for important accounts
- Use single sign-on systems
- Biometric solutions
2. Implement technical solutions
- Use throttling or account lockout
- Security monitoring
- Password deny lists
3. Protect all passwords
- Protect the access management system
- Protect passwords in transit
- Protect passwords at rest
- Prioritise securing important or vulnerable accounts
- Change all default passwords
4. Help users cope with password overload
- Use password management software or other secure storage
- Don't enforce regular password expiry
- Users must change their passwords when you know (or suspect) it has been compromised
5. Help users to generate better passwords
- Implementing machine-generated passwords
- Prevent users setting passwords that are too short
- Don't impose artificial capping on password length.
6. Use training to support key messages
- Emphasise the risks of re-using passwords across work and home accounts.
- Consider making your training applicable to their personal lives.
The NCSC recommend the following guidance to help users manage their passwords for home accounts. This will also potentially help them manage their full suite of passwords that cover both work and personal accounts, and reduce their overall password burden:
Protecting your business
It remains important for every business to educate its staff to recognise potential threats, and no one is immune to the risk of a cyber-attack. That means you should consider having protection in place in case the worst should happen.
According to the Cyber Security Breaches Survey 2021, however, under half of businesses (43%) have taken out some form of cyber insurance. Most standard property and liability policies have exclusions for cybercrime. This means it is vital for businesses to consider a standalone cyber-liability policy. TH March has been providing insurance for the jewellery sector for 135 years. While the nature of criminal threats has changed during that time, we’ve adapted to stay ahead and ensure jewellers get the protection they need.
We have access to specialised insurers who can provide jewellers with expert advice, guidance, and security strategies. This cover can include protection against a range of threats, including extortion, corporate ID theft and phishing. Should an attack occur, the business then receives cover to respond to the issue, including any legal or regulatory fees, as well as crisis communication and business interruption cover.
With growing numbers of jewellers falling victim to these crimes, can you afford to take the risk of not protecting your business?
To find out more about specialist insurance for jewellers from TH March, visit: www.thmarch.co.uk.
Source: SecurityWise