Are passwords obsolete? Rethinking passwords on World Password Day

World Password Day

A recent cyber crime and security study showed that during the fourth quarter of 2023, data breaches exposed more than eight million records worldwide. Today is World Password Day, an annual event held on the first Thursday in May dedicated to raising awareness about the importance of strong password security practices, evolving threats, and promoting better password management habits for both organisations and individuals.

The day provides a timely opportunity to reflect on the increasingly dangerous and complex landscape of cybersecurity and consider whether traditional password-based authentication methods are still sufficient in today’s digital age. While passwords have long been the cornerstone of online security, the ever-growing sophistication of cyber threats calls for a paradigm shift towards more sophisticated and innovative approaches to safeguarding our digital identities.

Moving towards more innovative approaches

Passwordless authentication is one such approach. Ironically, the best way to strengthen online security may be to eliminate passwords altogether. By leveraging technologies such as biometrics, hardware tokens, and cryptographic keys, organisations can authenticate users without relying on easily compromised passwords. This not only reduces the risk of data breaches but also streamlines the authentication process, enhancing productivity and user satisfaction.

But passwordless authentication is just one piece of the puzzle. Organisations should also consider implementing advanced and continuous authentication mechanisms. Unlike traditional binary authentication methods, which rely solely on passwords or static credentials, advanced authentication analyses a user’s behaviour and context to determine the level of access they should be granted. This could involve matching online behaviour patterns or triggering additional authentication steps when suspicious activity is detected.

Continuous authentication takes this a step further by constantly monitoring user activity and adjusting access controls in real-time. By doing so, organisations can mitigate the risk of unauthorised access and identity theft while providing a seamless user experience.

Pairing passwords with biometric technology is another effective way to increase account security. Biometrics, such as fingerprints, facial recognition, or iris scans, provide an additional layer of authentication that is inherently more secure than traditional passwords. By combining these technologies, organisations can create a multi-factor authentication system that significantly reduces the risk of unauthorised access.

Of course, using biometrics doesn’t come without its own risks. Biometric data, once compromised, cannot be easily replaced like passwords, and the growing availability of AI technology amplifies the risk of identity cloning. Paying ongoing attention, using secure storage practices, limiting the collection and storage of biometric data to what is absolutely necessary, and staying on top of the most up to date best practices is crucial for mitigating such risks.

Password best practice, because passwords are sticking around for now

But the reality is that passwords won’t disappear overnight. While there is a movement in the tech sphere to migrate away from passwords and towards more cyber-resilient technologies, passwords are still expected to remain a primary authentication technology in the coming years. For those still reliant on passwords, adherence to best practices is crucial. The following tips can help to ensure passwords are as secure as possible:

Complexity: Use a combination of uppercase and lowercase letters, numbers, and special characters to create a complex password that is difficult to guess.
Mnemonic Passwords: Craft a memorable yet complex password by using the initial letters of a meaningful phrase or sentence, substituting letters with similar-looking numbers or special characters. For instance, “I have two dogs named Max and Bella!” becomes “Ih2dNM@x&B3ll@!” This method ensures both security and ease of recall.
Length: Opt for longer passwords, as they are generally more secure than shorter ones. Aim for a minimum of 12 characters.
Random Generation: Utilise a random password generator to create highly secure passwords. These tools generate passwords that are difficult for hackers to predict or crack.
Unique Passwords: Use unique passwords for each of your accounts to prevent a single breach from compromising multiple accounts.
Avoid Common Patterns: Refrain from using easily guessable patterns such as “123456” or “password.” Similarly, avoid using common words or phrases.
Avoid Personal Information: Steer clear of using easily accessible personal information such as your name, birthdate, or address in your passwords.
Passphrase: Consider using a passphrase instead of a password. A passphrase is a sequence of words or a sentence that is easy to remember but difficult to guess.
Password Managers: Utilise a reputable password manager to securely store and generate complex passwords for each of your accounts. This eliminates the need to remember multiple passwords while ensuring they are strong and unique.
Two-Factor Authentication (2FA): Whenever possible, enable two-factor authentication (2FA) for an extra layer of security. This typically involves receiving a code on your phone or using a biometric scan in addition to entering your password.

World Password Day serves as a reminder of the importance of securing our digital identities in an age of increasing identity theft and cyber threats. A movement towards more secure technologies such as passwordless authentication, implementing advanced authentication mechanisms, and leveraging biometric technology, can help organisations strengthen their security posture and protect against evolving cyber threats. Whether it’s through eliminating passwords altogether or adopting multi-factor authentication, the key is to stay ahead of the curve and prioritise the security of our online accounts and sensitive information.

Training is essential

Additionally, ongoing training for cybersecurity is essential due to the constantly changing nature of cyber threats. Employees must be equipped with the knowledge and skills to recognise and respond to potential security risks such as phishing attempts, malware attacks, and social engineering tactics. Employees are actually known to be the weakest link when it comes to cyber security. Effective cybersecurity training programs help cultivate a culture of security awareness within organisations, empowering employees to play an active role in protecting sensitive information and assets.

VinciWorks’ vast and expanding cyber security training suite prepares users for all cyber risks. It includes hours of training, hundreds of micro-learning modules and topics from social media to IT security. These courses and micro-learning units can easily be configured into a multi-year training plan.

Learn more

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”