Security Market Segment LS
Friday, 22 April 2016 12:35

Warning: Passwords past ‘use by date’ as security threats mount Featured

By
David McNeely, Centrify David McNeely, Centrify

An over-dependence on passwords and a reliance on passwords that provide “as much protection as a piece of paper in a rainstorm” leaves many organisations vulnerable to cyber threats, a global security professional has warned.

According to David McNeely, Vice President of Product Strategy at identity management and security vendor Centrify, passwords are past their ‘used by date’ and the biggest threat to organisations is that hackers now have new easy access to readily available, open-source attack tools like Kali Linux, Metasploit and Mimikatz.

“The real difference is they (hackers) can use these tools to get beyond what we typically used in the past for defence,” McNeely warns.

McNeely – on a recent visit to Australia – told iTWire that there is a potential for poor password practices to combine with online systems to pose “the greatest threat to our privacy that we’ve ever seen”.

But, despite his gloomy outlook, McNeely maintains that one answer to overcoming the problem of ineffective passwords and vulnerable defence is for organisations to strengthen their security with Multi Factor Authentication (MFA) – despite resistance by some organisations around the world to a “proven solution” like MFA.

"Implementing Multi Factor Authentication in the enterprise has been an uphill battle as it can create a burden for IT as an organisation needs back-end structure to support it.

“Users are sometimes not ready for it so they can resist if they find it too cumbersome. There's always a trade-off between convenience and security, so it can be too inconvenient for rank-and-file users."

McNeely explains Multi Factor Authentication this way: “MFA combines something you know (a username and password, for example) with something you have (a token, magnetic card or phone) or something you are (a fingerprint, iris or voice)”.

While there is initial resistance to MFA, McNeely says there’s now the same level of interest multi factor authentication in Australia “just like we are seeing in the US” and “Australia is probably more advanced than some of our European customers”.

McNeely warns that compromised credentials are the most common vector of data breaches around the world. “There's no easier way for a hacker to attack a network than masquerading as a legitimate user of that network - and you get bonus points if it’s that user has a privileged account.

‘The really important point is that we already have the solution - but many places are not stepping up to use it. Even if a person's credentials are compromised, Multi Factor Authentication can foil a bad guy attempting to use those credentials to compromise a network.”

And, according to McNeely, one way for an organisation to shore up its defences against hackers is to by minimising the privileges of IT system user privileges. “Least Privilege. Give IT staff only the specific set of rights they need to do their jobs. So if someone does steal accounts, the downside is minimised.”

“Combine three things - least access, least privilege and MFA. All taken together provide a very strong defence posture and the first place to start is Multi Factor Authentication because it is the most effective defence.

“Protecting your identity and your accounts are the keys to your defence. The most important thing to do is treat security like the bad people are already on your network. Then you have a better chance of defending against those attacks.”

And, in the face of the growth in cyberthreats, McNeely says he is now starting to see people in IT focus on security as an asset “rather than just something to do when they get around to it”.

According to McNeely, more organisations are now moving to a cloud-based infrastructure and he cautions that you “almost have to treat a cloud-based server like a laptop”.

“When you give employees a laptop with data, you know they will go beyond your network perimeter, so you have to start thinking about a lot of other things. The risk exists when you move a server from your data centre to, say, Azure.

“We are helping number of customers move out applications and secure their cloud servers as more customers adopt cloud-based applications to do things that they used to run in their data centres. These include applications like HR, email and IT Service Management.”

McNeely says Centrify is encouraging its customers – including those he spoke to in Australia - to take up Multi Factor Authentication (MFA).

“Other areas include Identity and Access Management - these are taking a higher priority now than updating firewalls and adding VPN infrastructure. This means we can defend against these new types of attacks.”


Subscribe to ITWIRE UPDATE Newsletter here

GRAND OPENING OF THE ITWIRE SHOP

The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.

ENTER THE SHOP NOW!

INTRODUCING ITWIRE TV

iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the iTWire.com site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.

SEE WHAT'S ON ITWIRE TV NOW!

BACK TO HOME PAGE
Peter Dinham

Peter Dinham - retired in 2020. He is a veteran journalist and corporate communications consultant. He has worked as a journalist in all forms of media – newspapers/magazines, radio, television, press agency and now, online – including with the Canberra Times, The Examiner (Tasmania), the ABC and AAP-Reuters. As a freelance journalist he also had articles published in Australian and overseas magazines. He worked in the corporate communications/public relations sector, in-house with an airline, and as a senior executive in Australia of the world’s largest communications consultancy, Burson-Marsteller. He also ran his own communications consultancy and was a co-founder in Australia of the global photographic agency, the Image Bank (now Getty Images).

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & ON-DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments