Rishi Kaushal, Chief Information Officer at Entrust

"Identity continues to be the most targeted attack vector by bad actors with nearly two-thirds of data breaches caused by compromised credentials and AI is only accelerating new types of attacks. Our passwords should be an extension of our identities. You wouldn't share your social security number with just anyone, so why are your passwords any different? This World Password Day, we must look beyond typical password measures like alphanumerics and seek to improve how we are securing our data - taking a "never trust, always verify" approach to our accounts. 

Too many organizations either still rely on a single-factor authenticator like the password or enable relatively weak multi-factor authentication (MFA) with an over-reliance on one-time passcodes. Instead, we need to encourage implementations like phishing-resistant MFA technology, which requires more authentication than just a click or a compromised password to put you at risk - it is also a key foundation for organizations implementing Zero Trust principles. Another option is incorporating identity verification with authentication processes, adding biometric checks as step-up authentication. Organizations and consumers must work together to ensure their data is safe, and the combination of the right tools and mindsets will allow them to do just that."

++

Dave Spencer, Director of Product Management at Immersive Labs

"Bad actors are constantly searching for the weakest link in an organization's security posture. That weak link is often poor password management. Employees take the path of least resistance, which usually means satisfying the complexity requirements of passwords in the easiest way to remember possible. Most people attempt to pick strong, unique passwords for the numerous platforms they use which, unfortunately, only gives the illusion of security. In reality, this approach leaves numerous access points for attackers to infiltrate. With inadequate password hygiene being a common contributing factor in cyber incidents where credential stuffing and phishing attacks can expose corporate data as well as personal users, it's clear that both organizations and individuals need to reassess their password strategies. 

Rather than hope to keep data secure with only passwords, tools like multi-factor authentication (MFA) and password managers provide an added layer of protection, requiring bad actors to do extra work and limiting the avenues they can use to gain access to the sensitive information. But beyond implementing these tools, users need to know why these solutions are being utilized. A baseline knowledge of cybersecurity is necessary as we see more and more attacks targeting those who least suspect it. When we create a culture that prioritizes cyber resilience rather than finding out who to blame, we are more inclined to report malicious attempts at password stealing and other attacks.

However, it's crucial to choose your MFA method wisely. Push fatigue has become prevalent, where users mindlessly tap a button on their phone to authenticate, potentially authorizing requests without proper verification. This tendency to habitually tap away without confirming the legitimacy of the request can often happen, especially at the beginning of the day or post-lunch breaks."

++

Frederik Mennes, Director of Product Management & Business Strategy at OneSpan

"Today, organizations face a more threatening array of security concerns than ever before, and the average CISO faces immense pressure to safeguard the business. Traditional authentication such as passwords no longer offer effective protection against current threats. At the same time, more secure products like digital signatures combined with public key certificates in a public key infrastructure (PKI) often present implementation or usability challenges. In this setting, passwordless authentication emerges as a viable alternative, providing defense against evolving threats combined with enhanced usability.

Passwordless authentication methods have the capability to mitigate security risks by eliminating vulnerabilities associated with password-based credentials. It's the case because passwordless products do not rely on static passwords. Instead, they generate dynamic authentication codes that have a limited lifetime and can be used only once, or are based on unique human biometric characteristics, such as fingerprints.

Passwordless authentication has advanced in reducing the risk of breaches, allowing CISOs to build future-ready and adaptable systems for their organizations. Phishing-resistant passwordless authentication systems such as those based on FIDO standards can also eradicate the threat of phishing. With such products, they can safeguard corporate data, resources, and the wider workforce, while enabling a flexible workforce without compromising security. This can ensure a secure and user-friendly environment for dispersed workforces for 2024 - and well beyond."

++

Yiftach Keshet, Vice President & Identity Security Expert at Silverfort

"For businesses to improve and think more broadly about securing identities, there needs to be a perspective shift in how the most crucial entry point is protected- passwords.  Securing passwords with Multi-Factor Authentication (MFA) and not reusing passwords is basic security hygiene, yet we should continue doing it. However, it's 2024. Organizations need to take the conversation beyond passwords for human identities and start talking about how to successfully protect the other tools attackers use, such as command line tools, PowerShell, and machine-to-machine communication. I'd like to get to a place where CISOs demand strong MFA protections for their non-human identities and the critical resources MFA can't secure. 

World Password Day serves as a reminder that identity gaps throughout the identity infrastructure continue to cause many major breaches. If a hacker successfully steals a password, it's easy for them to move discreetly throughout an environment and even use identity infrastructure as a gateway to access cloud assets and environments. Recent research found that 67% of organizations sync their on-prem passwords to the cloud. While this is convenient and can help boost employee productivity, it also dramatically increases risk by creating a gateway for cybercriminals to jump from on-prem to the cloud and wreak havoc on an entire organization's network. 

Security leaders should ask themselves how they can secure the identity infrastructure that often leads to compromise. When organizations start having more conversations about the forgotten resources that go unprotected and how to secure them, we'll advance security to a place that can actually stop an attacker in their tracks." 

++

Joe Richard, Associate Director of Program Management at Nightwing (formerly Raytheon)

"As digital infrastructures grow more interconnected and complex, an organization's priceless data and mission-critical systems are increasingly vulnerable to cyberattacks. An effective cybersecurity strategy requires multiple layers of defense spanning networks, endpoints, data, and user access. 

Passwords are often viewed as the first layer of defense, serving as the primary means for authentication and access control. Frequently, poor practices and prioritization of convenience over security leave this layer susceptible to multiple attack vectors such as brute force attacks, phishing campaigns, and social engineering.

We all share responsibility for fortifying this layer of defense; however, organizations must assume that advanced attackers will eventually find a way inside the security perimeter. Beyond password discipline, organizations should embrace zero-trust principles to continuously authenticate every user, device, and application attempting to access DT resources. Organizations should also include cyber resiliency measures to adapt, withstand, and recover from potential attacks.

As users, and as stewards of our organization's security, we must all pay attention to our cyber hygiene by making sure our passwords are secure, complex, and regularly updated. It's up to each of us to do all we can to bolster this first layer of defense to prevent criminals from accessing networks, stealing sensitive information, and undermining systems."

++

Viktoria Ruubel, Managing Director of Digital Identity at Veriff

"In the past year alone, there has been a 71% increase in attacks that use stolen passwords. As the digital landscape continues to evolve, passwords are no longer the most secure method to protect their data. In fact, two-thirds of consumers feel facial recognition software provides easier and safer access to online accounts than passwords.  Consumers would accept a longer sign-up process involving the use of an ID document and a selfie if it means better identity and personal data protection.

Relying on legacy approaches like two-factor authentication or knowledge-based authentication (using knowledge of a mother's maiden name, for example) can expose an organization to bad actors.  Passwords are vulnerable to data breaches and malware, and two-factor authentication is susceptible to device compromise and social engineering.  

We must improve how accounts are secured, like pairing passwords with biometric technology. A report found that 38.5% of respondents believe facial recognition and biometrics are the most secure method for protecting their accounts and information.  In addition, biometric data is hard to steal and cannot be forgotten like a password. When you add biometric facial authentication on top of password protections, sign-in becomes secure and seamless. 

While there is no one-size-fits-all solution to combating fraud, this World Password Day we should seek solutions that can complement and augment existing security measures."

++ 

Doug Kersten, CISO, Appfire

"Today, malicious threats are much less predictable and, therefore, more difficult to defend against. While passwords were once the key to safeguarding private information, attackers have perfected countless techniques to access them.

Regardless of whether you're using a professional or personal device, it's essential that your passwords are unique, difficult to guess, and not used across a variety of devices or platforms. World Password Day is a great reminder to stop and think about the last time you audited the passwords you're using, where you're storing that information and whether that information is easily accessible, and to take the time to change the passwords you use frequently or you know have been compromised in data leaks. 

Many internet browsers are improving their password protection practices, sharing with users their security blind spots. However, responsibility remains with the user to take the next step to change compromised passwords. Always think in terms of something you are - your user name; something you know - your password and something you have - a device or software that provides a second factor, such as biometrics or authentication codes from common and free authenticator apps like Google or Microsoft Authenticator. Using these in a thoughtful way will greatly reduce the impact of a password compromise and make for a very happy World Password Day." 

++ 

Patrick Harding, Chief Architect at Ping Identity

"As threat actors become more sophisticated and lean on new technology like artificial intelligence, most users underestimate the risks associated with relying on passwords to protect valuable information. On top of that, a whopping 48% of IT decision-makers are not confident they have technology in place to defend against AI attacks. Traditional passwords make organizations vulnerable to these types of attacks, leaving the door open for hackers to access critical data. Consumers have also become increasingly frustrated with remembering multiple, complex passwords and often choose to reuse the same password on various sites, increasing security risks even further. 

The good news is there are more secure alternatives that provide better digital experiences for the user. Passwordless authentication replaces traditional passwords with more seamless and secure methods and helps enterprises reduce risk and stop threats at scale. This World Password Day, let's focus on moving towards a passwordless future that offers better and safer digital experiences while educating organizations about technology that strengthens security." 

++

Thomas Epps, IT Product Specialist at LG’s IT division
 
"We can no longer rely on passwords alone to maintain good cybersecurity hygiene in organisations. Bad actors are skilled at using brute force to decode passwords and breach systems. So, passwords must be supplemented with additional layers of security.  
 
“Powerful innovations in biometric technologies and AI-powered smart security can augment passwords and support users in taking extra measures that protect their online identity. For example, face, eye and gaze sensing can be used to intuitively lock and unlock screens when users look away, while AI can help instantly identify any unusual activity and alert consumers of potential breaches. With preventative measures in place, individuals can be empowered to practice safe security and better protect their online identity and presence."

++

Morgan Wright, Chief Security Advisor, SentinelOne

"There was a time when moats protected castles, and knights in shining armor on horseback defended the kingdom. There was also a time when passwords protected the most valuable of secrets. Like moats and knights, that era has passed.

Identity is the new perimeter. Subscribing to the antiquated notion that a password is the first and last line of defense has been eclipsed by the modern threat environment. If your security depends solely on the strength of a password, you are going to be disappointed in quick fashion.

There will be those who cling to their passwords and reject modern approaches, like biometrics and advanced authentication techniques and technology. They will become a footnote in digital history, referred to only in anecdotes that start with “Back in my day…”.

If William Shakespeare were alive today, his great poem Caesar may have started differently.

'Friends, Romans, countrymen, lend me your ears; I come to bury passwords, not to praise them.'"

++

Raffael Marty, General Manager, Cybersecurity, ConnectWise

"Stolen credentials are one of the top attack vectors in the MSP space, providing cybercriminals with an entry point to bypass an organization's security measures and gain access to important systems and accounts. As a result, critical information, such as intellectual property, sensitive financial or healthcare data, can be stolen and exploited by hackers. Unfortunately, these concerns are heightened by threat actors increasing their focus on defense evasion tactics to avoid detection.

To combat this growing issue, MSPs and their customers should seek to adopt at least a basic password management approach by using password managers. If possible, additional protections should be put in place, such as multi-factor authentication (MFA), or adaptive zero-trust approaches that enforce additional standards. For example, when logging into systems, the originating machine has to be patched and needs to run necessary security tools. This World Password Day is a reminder that MSPs and MSSPs need to educate their customers about the concerns of poor password management and security while re-evaluating why they are still using passwords in the first place."

++

Bojan Simic, Co-founder and CEO, HYPR

"Since the first World Password Day in 2005, great strides have been made to protect digital identities but, it's time for this annual observance to emphasize user friendly FIDO-based authentication systems like passkeys.

Securing authentication methods is of utmost importance, as it is often one of the top entry points for cyberattacks. Passkeys use public-private key cryptography making them phishing-resistant, and providing enhanced protection against common attack vectors, like brute force attacks, credential stuffing, and AitM (adversary-in-the-middle). Unlike traditional passwords and other forms of authentication, like one-time-passwords (OTPs), SMS and email links, there are no shared secrets. The confidential credential is not transmitted, so interception, theft, breaches, or cracking is implausible.

We envision a future where enterprise leaders embrace the new business imperative and shift away from password use, toward the deployment and widespread adoption of passkeys to fortify existing cyber defenses."

++

Erik Nordquist, Managed Security Product Director at GTT

"Password sharing continues to be alarmingly common, and businesses should be particularly concerned because many people use the same passwords for both personal and business accounts. This puts not only their own situation at risk but also enables bad actors to gain access to corporate systems and infrastructure. Cybercriminals can use infected devices to launch ransomware and other attacks, often undetected. It's crucial that all businesses put strong password policies into place to protect their organization's security. Regularly changing passwords, using strong and unique passwords for each account, and implementing two-factor authentication can help mitigate the risks associated with password compromise. Educating employees on the importance of password hygiene and the dangers of password sharing is also essential in maintaining a robust cybersecurity posture."

++

Paul Walker, field strategist, Omada

"Multi-factor authentication has rapidly become a critical security feature supported by most identity providers, essentially eliminating the need to enter passwords. A growing majority of business users can now go days or even weeks without having to enter a password. Methods like Windows Hello, for instance, allow users to sign into their devices and use major browsers by authenticating through things like facial recognition, fingerprint scans, and PINs.  
 
That said, even as many companies and solutions add additional layers, passwords are still often used as a fallback. While the password is no longer the only option, it’s still a required one in many circumstances. Contrary to rumors of its demise, the password is still with us for the foreseeable future. And that means we have to account for that. Most users are going to forget their passwords, especially if they’re not using it daily. That requires them to go through a sometimes clunky password reset process. As a user, you can and should ask your organization for a secure password manager to eliminate some of this pain. And if, as an organization, you haven’t already put such a tool in place, there’s no time to wait."

++

Domingo Guerra, EVP Trust, GM North America, Incode

"As many companies announce plans to shift to “passwordless,” biometrics for identification have exploded rapidly across all sectors. The primary driver of biometrics adoption is speed/ease of use. Facial recognition, or Face Factor Authentication (FFA) is a prominent means of verifying user identity; it’s quick and easy for customers to capture a selfie, for instance.  
 
The second primary driver is security. Today, biometrics are harder to spoof or circumvent than other types of identity authenticators. As irrevocably damaging digital threats like deepfakes become more sophisticated, organizations need a way to be able to prove someone’s identity with utmost certainty. Biometrics are replacing obsolete systems like passwords, PIN numbers, and physical ID cards that are prone to fraud and error, and easily be faked or lost.  Further, the rise in phishing and social engineering have presented a challenge for many users. Fraudsters and cyber criminals are experts in getting users to compromise their passwords or security tokens, and experts at tricking Help Desks to grant access to accounts by impersonating legitimate users.
 
The advantages of using biometrics for verification and authentication are two-fold. Firstly, it provides customers with speed, convenience, and confidence that their data and access will be protected. Secondly, it ensures businesses are going the extra mile and practicing due diligence by comprehensively evaluating all identity signals, enhancing customer trust. Finally, biometric authentication authentication offer a benefit that has never existed before: it makes it impossible to forget or lose your password or authentication device.  In an increasingly interconnected world where real-world and digital identities intertwine, robust biometric verification and authentication play a pivotal role in establishing and maintaining digital trust."

++

Jason Kent, Hacker in Residence, Cequence Security

"On World Password Day, individuals and organizations must prioritize robust password practices. While convenient, the widespread practice of reusing passwords across multiple accounts introduces significant security risks. A single data breach can have cascading consequences if identical credentials are used elsewhere.
 
To mitigate this risk, it is imperative to adopt a unique password for each online account. Consider incorporating biometric authentication (fingerprint or facial recognition) for mobile apps where supported, as this provides an additional layer of protection. While managing numerous passwords may seem daunting, there are effective solutions available. Using reputable online password managers can help individuals organize and secure their credentials efficiently. These tools securely store and synchronize credentials across devices, ensuring accessibility without compromising security. Just keep in mind, this is a single place to attack and gain all of your passwords so this is a great example of needing multi-factors of authentication (Something you know, Something you have, Something you are) to access that particular system.  
 
Users should also update passwords regularly, especially for accounts containing sensitive data such as password managers, financial or healthcare information. By embracing these practices, individuals and organizations significantly strengthen their password hygiene, minimizing the likelihood of security breaches."

++

Mike Loukides, vice president of emerging technology content, O'Reilly

"In one form or another, passwords have been around for thousands of years. And they've been a bad idea the whole time. Passwords are entirely too easy to guess. The common practice of password rotation makes the problem worse, not better--a fact recognized by organizations as authoritative as the US National Security Agency and the National Institute of Standards and Technology.

But we've also failed to come up with good alternatives. Authentication is a difficult problem. Passwords are still problematic, but less so when they're combined with one or more other forms of identification. There's no excuse for not practicing multi-factor authentication. The simplest form of 2-factor authentication is sending a text to a cellphone with a one-time code. That has its problems, but it's adequate.

Some alternatives to passwords are passphrases, which are short sequences of words that are much longer than individual passwords. My guess is that passphrases would prove to be almost as easy to guess as passwords, if they were widely used. Security keys are physical devices that plug into a USB port. They should be more widely used than they are, but like any small physical device, they can be lost. They aren't expensive individually, but costs add up as organizations get large; and USB connectors change from time to time. Passkeys are a widely implemented cryptographic standard, but they are difficult to configure correctly, and the standard has loopholes that make interoperability a problem. Nothing is going to work when vendors are trying to use a standard to implement a walled garden.

Biometrics is the one alternative that seems to be getting broad acceptance. Most new cell phones support either fingerprint or face recognition. But that has its own problems. If someone steals a fingerprint database, you can't change your print. And face recognition doesn't work in the dark, or if you take off your glasses, or even get a new hairstyle.

Passwords are a problem, but we really don't have any good alternatives yet. That may be the biggest problem facing the security industry."

++

Deepak Taneja, CEO and Co-Founder, Zilla Security

"Identity security and governance is top of mind for most CISOs. In a recent multi-city CISO event that Zilla Security participated in, 70+ % of the CISOs indicated that identity was their highest priority for the next 12 months. This is no surprise since the majority of data breaches stem from access vulnerabilities.
 
One of the tenets of identity security is password management and authentication, which are critical to protecting an organization's digital identities. On World Password Day, we are reminded of the importance of adopting strong, unique passwords to protect against identity threats, in addition to proactively and continuously managing permissions for every identity - human or machine - across every application in the enterprise."

++
 
Russ Kennedy, Chief Product Officer, Nasuni

"World Password Day serves as an annual reminder that passwords are often the first line of defense against unauthorized access to an organization’s sensitive information. The strength and uniqueness of passwords are essential components of cyber hygiene practices, in addition to employing single-sign on and two-factor authentication practices.
 
However, it's important to recognize that password security is just one piece of the puzzle. Equally important is the protection of file data and the ongoing vigilance against the growing threat of ransomware attacks. With cyber threats constantly evolving, adopting a holistic strategy to cybersecurity, which includes regularly updating passwords, employing data backup and encryption methods to secure files, and implementing robust ransomware protection measures, becomes imperative in safeguarding our digital assets and privacy."

##