{"id":4911,"date":"2020-05-07T12:20:24","date_gmt":"2020-05-07T16:20:24","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=4911"},"modified":"2020-05-07T12:20:24","modified_gmt":"2020-05-07T16:20:24","slug":"world-password-day-2020-passwordless-credential-stuffing-and-password-managers","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/world-password-day-2020-passwordless-credential-stuffing-and-password-managers\/","title":{"rendered":"World Password Day 2020: Passwordless, Credential Stuffing, and Password Managers"},"content":{"rendered":"

\"World<\/p>\n

World Password Day 2020 continues as cybersecurity experts from around the world discuss the topics at the forefront of password security. These include passwordless authentication, credential stuffing attacks, password managers, and more.\u00a0<\/span><\/p>\n

For more on these topics, we consulted with cybersecurity experts. Here\u2019s what they had to say.\u00a0<\/span><\/p>\n


Widget not in any sidebars
<\/b><\/p>\n

World Password Day 2020: Passwordless, Credential Stuffing, and Password Managers<\/b><\/h2>\n

Fausto Oliveira<\/b><\/h3>\n

Fausto Oliveira is Principal Security Architect at <\/span><\/i>Acceptto<\/span><\/i><\/a>.<\/span><\/i>\u00a0<\/span><\/p>\n

\u201cPasswordless is not the future. It\u2019s what we need now. Every year, security incidents continue to occur due to account takeover and the causes are well known. The most relevant of them is credential hijacking which accounts for approximately 80 percent of attacks. In the past, the focus on password complexity encouraged credential re-usage and increased the total cost of ownership (TCO) associated with password resets and Helpdesk calls without improving overall security.\u00a0<\/span><\/p>\n

In general, any binary authentication, such as passwords, two-factor authentication (2FA), and some multi-factor authentication (MFA), including biometrics, are susceptible to fraud due to their binary nature. The industry needs to move away from passwords and start adopting passwordless solutions that do not treat authentication as a single event with a simple yes or no at point of entry, but as a continuum where user good behavior is constantly verified. It\u2019s time to finally make World Password Day a thing of the past.”<\/span><\/p>\n

Tim Wade\u00a0<\/b><\/h3>\n

Tim Wade is Technical Director of the CTO Team at <\/span><\/i>Vectra<\/span><\/i><\/a>.<\/span><\/i><\/p>\n

\u201cWhile <\/span>passwordless<\/span><\/i> authentication is admirable and authentication systems solely based on passwords have been, and will continue to be, abused it\u2019s important to consider that an effective authentication system must also account for effective credential revocation and replacement as much as credential strength\u2014there are few things more trivially revoked and replaced than the knowledge inside someone\u2019s head.\u00a0 At the risk of unpopularly defending the merits of passwords, they may continue to have a role to play in strong, robust, multi-factor authentication systems even as they\u2019re replaced as the sole (or even most important) anchor of authentication.\u201d<\/span><\/p>\n

Joseph Carson\u00a0<\/b><\/h3>\n

Joseph Carson is Chief Security Scientist and Advisory CISO at <\/span><\/i>Thycotic<\/span><\/i><\/a>.<\/span><\/i>\u00a0<\/span><\/p>\n

\u201cWorld Password Day is a day to review your password hygiene to ensure you are up to date with the latest best practices.\u00a0 However,\u00a0 if you have not combined it with another security control such as two-factor authentication, you\u2019re leaving the door wide open,\u00a0 putting yourself at risk of identity theft, ransomware, an online account hack, computer viruses, and more.\u00a0 It is also important when you do change your password to only perform this task from a safe network and not a public location.<\/span><\/p>\n

This year, review your password best practices. Ensure that you have started to use passphrases to help make your password long and include some complexity as well, although the debate about how frequent you should change your password continues. My recommendation is that it should not be older than one year. It\u2019s best not to wait until you are notified about a data breach as it usually means cybercriminals had access for longer than two hundred days.\u201d\u00a0\u00a0\u00a0<\/span><\/p>\n

Bryan Becker<\/b><\/h3>\n

Bryan Becker is Product Manager and Researcher at<\/span><\/i> WhiteHat Security<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n

\u201cThe recent credential stuffing campaigns against the World Health Organization and Gates Foundation and breach of children\u2019s site Webkinz reinforce the importance of setting a different username\/password combination for every application you utilize as an end-user to protect your own information and your employer\u2019s. It is essential to practice security mindedness as you browse the web to lessen the impact data breaches will have on you and your organization once they occur. Some other tips you can practice to secure yourself online are:<\/span><\/p>\n