Express Computer
Home  »  Guest Blogs  »  Weak passwords are the biggest threat to organisational cybersecurity

Weak passwords are the biggest threat to organisational cybersecurity

0 1,250

By Sairaman Srinivasan, Chief Strategy Officer, Consortium for Technical Education (CTE)

One of the significant security issues organisations globally face in the cybersecurity landscape is weak and default passwords. These issues can affect organisations of all sizes and types, from small businesses to large corporations, non-profit organisations, and government agencies. According to various studies and reports, weak and default passwords are among the top causes of data breaches and cyber-attacks. The Verizon 2021 Data Breach Investigations Report found that 61% of breaches involved credential data.

Default and weak passwords are a significant threat to organisational cybersecurity. Device manufacturers and software vendors use default passwords that are often easy to guess, making it easy for hackers to access systems and devices. On the other hand, weak passwords are easily guessable because they are too short, simple, or widely used. Hackers can use various techniques to decrypt weak passwords, including brute force attacks, dictionary attacks, and phishing.

Addressing concerns around default and weak passwords

The primary risk associated with default passwords is their widespread availability and ease of access for potential attackers, making the devices highly vulnerable. These passwords are provided by device manufacturers and service providers as temporary access credentials during device installation or configuration.

When users or system administrators fail to change or reset the default passwords, their systems are vulnerable to attacks. Attackers can easily locate these default passwords on the vendor’s website or through trial and error, as they are often simple and commonly used words or numbers.
Unfortunately, many organisations have a widespread problem with using default or weak password practices. Passwords such as “123456”, “qwerty”, “admin”, “admin@123”, and “password” consistently remain among the most commonly used passwords. If these passwords are reused across multiple accounts, it becomes even easier for attackers to gain access to sensitive corporate information.

Furthermore, when devices and services with default passwords are connected to the internet, malicious actors can use simple techniques like credential stuffing and password spraying to exploit these vulnerabilities, gaining unauthorised access to devices. This can lead to significant consequences, including data breaches, access to sensitive information, financial loss, or even identity theft. Therefore, changing default passwords immediately after device installation or configuration is highly recommended and crucial. Selecting strong and distinct passwords to safeguard devices and accounts within the network is considered the best practice.

Implementing safeguarding measures

To start with, it’s crucial to take steps that can prevent a security breach resulting from vulnerable or default passwords. Therefore, organisations must develop a comprehensive incident response strategy, like encouraging users to use stronger passwords, enforcing a password policy that specifies the requirements for passwords, such as length and complexity, creating a password deny list to prevent users from choosing common, weak passwords, organising security awareness and training programs to educate users about the importance of changing passwords after a security incident and why it requires to deny access to users who have made a certain number of unsuccessful/failed login attempts.

To incorporate an additional layer of security, it’s critical that databases containing sensitive information are properly configured and that the residing data is encrypted. It is recommended that users regularly rotate their login credentials and implement multi-factor authentication (MFA) to ensure that an attacker cannot access user credentials, even if they have access to the account.

Implementing Two-Factor Authentication (2FA) aims to increase the security level beyond just using passwords alone, as passwords can be compromised. 2FA is a security mechanism where users are provided with two different forms of authentication to access their accounts. In the context of password security, 2FA entails using a second-factor authentication, such as a mobile device (to receive the OTP), in addition to the password, to verify the user’s identity.

Although 2FA is an effective security measure, it is partially infallible, and users should still take precautions to ensure that their passwords are robust, well-protected, and changed regularly.

To conclude

The most significant danger to an organisation’s cybersecurity is weak and compromised passwords, which not only make it easier for brute-force attacks to occur but also, having weak passwords increase the risk of ransomware attacks. Therefore, using strong, unique, uncompromised passwords is crucial because implementing advanced security measures alone is not enough to safeguard organisational networks and systems.

Get real time updates directly on you device, subscribe now.

Leave A Reply

Your email address will not be published.

LIVE Webinar

Digitize your HR practice with extensions to success factors

Join us for a virtual meeting on how organizations can use these extensions to not just provide a better experience to its’ employees, but also to significantly improve the efficiency of the HR processes
REGISTER NOW 

Stay updated with News, Trending Stories & Conferences with Express Computer
Follow us on Linkedin
India's Leading e-Governance Summit is here!!! Attend and Know more.
Register Now!
close-image
Attend Webinar & Enhance Your Organisation's Digital Experience.
Register Now
close-image
Enable A Truly Seamless & Secure Workplace.
Register Now
close-image
Attend Inida's Largest BFSI Technology Conclave!
Register Now
close-image
Know how to protect your company in digital era.
Register Now
close-image
Protect Your Critical Assets From Well-Organized Hackers
Register Now
close-image
Find Solutions to Maintain Productivity
Register Now
close-image
Live Webinar : Improve customer experience with Voice Bots
Register Now
close-image
Live Event: Technology Day- Kerala, E- Governance Champions Awards
Register Now
close-image
Virtual Conference : Learn to Automate complex Business Processes
Register Now
close-image