A Password Management Report Card

The phrase "password management" engenders similar reactions from both those responsible for cybersecurity and the individuals who must use passwords. It's a "trying necessity."

To address the issues associated with password management, there is a good selection of tools available to teams, businesses, and enterprises. However, these products need to adapt and evolve to win new business, protect against new cybersecurity threats, and support the move toward a "password-less" enterprise. Recent research from Ovum, a UK-based analysis firm, evaluated a dozen of the most prominent players in the account credential market, assessing the relative strengths and weaknesses of 12 competing offerings. Here is a summary of our findings:

Advice to Enterprises: User Password Mangers & MFA
Among a range of Ovum recommendations for enterprises, adopting any trusted password manager is almost always going to be better than not adopting one at all. Our research reveals that over 80% of major data breaches can be traced back to a single compromised identity, so password management needs to be on the top of the cybersecurity agenda. Ovum also recommends that enterprises evaluate products originating in the consumer market and consider the benefits of offering password management tools that employees can extend for personal use. It could make practical sense to deploy more than one product in larger organizations.

If an enterprise is moving business and productivity workloads to the cloud, give consideration to adding strong authentication to enhance the security of employee user IDs and passwords. Password managers present an obvious target for hackers and cybercriminals, so consider which multifactor authentication mechanisms are likely to work best for staff and employees.

Security should be at the heart of any modern digital workplace strategy; therefore, password management tools must be considered alongside device, operating system, browser, and application management strategies. Microsoft and Google are introducing customers to their password-less strategies, so IT and security teams should consider the relevance of these initiatives as part of any password management-related project.

SaaS & Cloud
Organizations adopting password management products need to do their due diligence, especially if they are operating in regulated industries or where strict security protocols are in place. Be aware that it's the customer organization not the security vendor, who has responsibility for ensuring compliance with applicable laws and regulations. When considering software-as-a-service and cloud-based solutions, businesses and institutions should look for relevant vendor certifications, accreditations, and reporting standards, such as SOC 2 for trust, ISO 27001 for information security management, ISO 22301 for business continuity, PCI DSS for payment security, and ISO 27018 for protection of personally identifiable information.

The FIDO Alliance is an influential industry association from the perspective of the world’s over-reliance on passwords, and it is worth noting that Dashlane, Keeper Security, and LastPass (LogMeIn) are associate-level members. The FIDO Alliance is working to change the nature of authentication with open standards that are more secure than passwords, simpler for consumers to use, and easier for service providers to deploy and manage. That said, among its recommendations, Ovum suggests that businesses give consideration to vendors that support the FIDO Alliance in promoting a password-less future while also addressing the immediate needs of the market.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.