{"id":38793,"date":"2020-05-13T14:24:35","date_gmt":"2020-05-13T13:24:35","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/2020\/05\/13\/world-password-day-watertight-security-evolves-from-vigilance\/"},"modified":"2020-05-18T15:14:56","modified_gmt":"2020-05-18T14:14:56","slug":"world-password-day-watertight-security-evolves-from-vigilance","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2020\/05\/13\/world-password-day-watertight-security-evolves-from-vigilance\/","title":{"rendered":"Watertight security evolves from vigilance"},"content":{"rendered":"\n<p><em>As password protection is as dominant a subject as ever in the cybersecurity space, we asked industry experts how they would advise staying secure in a password-driven society, particularly as COVID-19 has meant a spike in cyberattacks. <\/em><\/p>\n\n\n\n<p>Passwords: so simple, yet so effective. They have been regularly used for so many years that it\u2019s hard to imagine an alternative for them. And it\u2019s only more recently that technologies like fingerprint ID have even created an alternative.&nbsp;<\/p>\n\n\n\n<p>Although there is a very strong temptation to use the same password for everything \u2013 all while writing it down in a \u2018safe\u2019 place \u2013 it is important to remember passwords are only as strong as you make them.&nbsp;<\/p>\n\n\n\n<p>We asked technology experts to gather their thoughts and advice on business best practice of the commonly misused tools.<\/p>\n\n\n\n<p><strong>Some sound advice<\/strong><\/p>\n\n\n\n<p>Passwords are often associated with inconvenience \u2013 and for good reason. Employees and consumers alike are overwhelmed by the thought of remembering login details for 100-200 websites and making them difficult for bad actors to guess. \u201cIt\u2019s important to look at the practical solutions to this impractical problem, accelerated by more and more aspects of our lives going online,\u201d said Jay Ryerse, VP of Cybersecurity Initiatives at ConnectWise.<\/p>\n\n\n\n<p>Ryerse continued: \u201cTo ensure your personal and work-related accounts, as well as the sensitive data residing within them, remain secure:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Use a password manager &#8211; but do your research. Some have been breached in the past and you want to make sure your choice is reliable, safe and up to date<\/li><li>Use a different, complex password for every website. This reduces your risk of credential stuffing attacks, where hackers take login details harvested from breached websites to log into users\u2019 accounts on other unaffected sites. A password manager makes this process much easier as it will create lengthy, unique passwords for each site<\/li><li>Remember that the longer the password, the longer it takes for digital adversaries to crack it, thus deterring successful brute force attacks<\/li><li>Avoid overused practices like adding an exclamation point at the end, including phrases associated with family or pets, or using incremental numbers. Hackers use these well-known patterns to guess your password and you\u2019ll make their jobs easier<\/li><li>Give only fake answers to security questions that would help you recover your password, so hackers cannot mine that information from snooping you online. One example would be your mother\u2019s maiden name &#8211; with some social media searching, this would be easy to identify, so choose a made up name that only you would know<\/li><li>Implement multifactor authentication wherever possible to create extra hurdles for cybercriminals<\/li><\/ul>\n\n\n\n<p>\u201cThere will always be varying degrees of account compromise,\u201d said Ryerse. \u201cIf someone hacked my LinkedIn, they might post something embarrassing, but it\u2019s easy to change the password and regain control. However, if they broke into my online bank account or used my credit card on Amazon to rack up charges, we\u2019d be looking at significant damage. Wouldn\u2019t it be better to prevent all of these incidents, though? Implementing these best practices across your online presence will do just that&nbsp;\u2013 and protect both you and your company on an ongoing basis.\u201d<\/p>\n\n\n\n<p><strong>Keeping the public sector private&nbsp;<\/strong><\/p>\n\n\n\n<p>Although the mass migration to remote working has brought a handful of benefits, the cybersecurity landscape has never been more muddled. \u201cThe sudden increase in the number of remote workers has been accompanied by a spike in phishing scams and spam attacks as hackers ruthlessly use the COVID-19 crisis to their advantage,\u201d said Sascha Giese, Head Geek at SolarWinds. \u201cIn the public sector \u2013 as in every sector \u2013 IT pros have to contend with keeping stressed IT systems functioning while working from home, and now this dramatic surge in cybersecurity threats as well.<\/p>\n\n\n\n<p>\u201cBut in the face of such adversity, the simplest measures, such as password protection, can often prove the most effective. At times like this, remember passwords act as vital gatekeepers to the most sensitive data. Strengthening password habits such as regularly changing them and using two-factor authentication (2FA) makes it harder for hackers to gain access to data and information. For the public sector, 2FA is a very effective additional layer of security that requires not just a username and password, but also something completely unique to that user, whether it be a piece of information or a physical token. It\u2019s based on the concept that only those users will gain access based on something they know (knowledge) and something they have (possession). Such a system makes it much more resistant to attack, and in our current times is reassuring for both system administrators and the public.&#8221;<\/p>\n\n\n\n<p><strong>Monitoring operations remotely<\/strong><\/p>\n\n\n\n<p>Ordinarily, it is important to remember how crucial it is to change and update passwords frequently, but especially in current circumstances. Steve Nice, Chief Security Technologist at Node4, said: \u201cOne of the biggest threats to IT security is \u2018shadow IT\u2019 \u2013 where the security team has limited or no visibility into the applications and tools employees are using. Many employees will be deploying remote collaboration tools independently of their organisation\u2019s IT departments and these are not subject to the same due diligence and testing that would normally be undertaken. This means security, data sovereignty, compliance and retention are all outside of the organisation\u2019s control.<\/p>\n\n\n\n<p>\u201cOnce we all get back to working \u2018normally\u2019 in offices again, many of these collaboration applications will be forgotten and this poses new security problems. Many of these apps will not be updated again and will therefore be vulnerable for exploitation by hackers. On top of this, login credentials \u2013 which will likely include easy-to-guess passwords anyway \u2013 may get compromised and be utilised for other attacks, such as phishing.<\/p>\n\n\n\n<p>\u201cThree tips for your staff are: not to reuse passwords; have complex passwords; and enable multi-factor authentication whenever available. Beyond this, ensuring employees are still getting the basics right while working remotely is key. Password managers, for example, can limit the risk associated with dormant applications, so even if \u2018shadow IT\u2019 collaboration tools are being used and left, the credentials remain up-to-date.\u201d<\/p>\n\n\n\n<p><strong>When passwords alone are not enough<\/strong><\/p>\n\n\n\n<p>For individuals seeking to protect their personal information and secure their online accounts, a strong password is a critical first line of defence. \u201cBut, if you are a commercial, nonprofit or government organisation, a password, regardless of how unique or how often it is updated, will barely scratch the IT security surface,&#8221; said Mihir Shah, CEO, Nexsan, a StorCentric company. &#8220;The only true protection for an organisation\u2019s high value data is to aggressively lock it down using a hardened storage solution that has been engineered with the understanding that attempts at corruption or deletion can come from anyone, anywhere and at any time. The solution must be capable of recognising and rejecting every such attempt, regardless of whether it\u2019s from a virus, ransomware, spyware, user mistakes, software error \u2013 or a new threat that hasn\u2019t even been discovered yet.\u201d<\/p>\n\n\n\n<p>With developments in the situation around COVID-19 occurring daily, it is important for businesses \u2013 and their employees \u2013 to think about what steps they can take to best protect their important data and avoid any security crises that would make an already turbulent landscape worse. Utilising passwords is one way of doing this, but they are a tool that must be treated with respect and vigilance.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As password protection is as dominant a subject as ever in the cybersecurity space, we asked industry experts how they would advise staying secure in a password-driven society, particularly as COVID-19 has meant a spike in cyberattacks. Passwords: so simple, yet so effective. They have been regularly used for so many years that it\u2019s hard [&hellip;]<\/p>\n","protected":false},"author":21,"featured_media":38896,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[57,1489,29,93],"tags":[7364,14492,8301,14712],"class_list":["post-38793","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-insights","category-software","category-top-stories","tag-connectwise","tag-covid-19","tag-nexsan","tag-password-protection"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/38793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=38793"}],"version-history":[{"count":3,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/38793\/revisions"}],"predecessor-version":[{"id":38872,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/38793\/revisions\/38872"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/38896"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=38793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=38793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=38793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}