In-depth

Building a business case for password managers

Davey Winder ponders the best way for SMBs (and larger firms) to tackle the thorny issue of password security

Passwords have always been at the heart of data security policies, and often data security breach reporting as well. Be it the password re-use question, the too simple to crack versus too complex to remember debate, or, as I touched upon recently, whether passwords are old tech that should be sent to the security scrap heap.

The unravelling Heartbleed saga has brought the password problem to the fore once more for both enterprise users and consumers.

Wearing my small business security consultant hat, one of the arguments I often find myself on the receiving end of is that I shouldn't be recommending the use of password managers as a solution.

"They are OK for the consumer who has no business critical data to protect, but even then the adoption case is a marginal one in terms of the security they offer," I am repeatedly told by people who usually fall into one of two categories.

The first are security consultants who deal exclusively with the medium-to-large' bit of the SMB sector. No consultant in their right mind would recommend consumer-grade password manager software to this level of enterprise application. Just because they are not an acceptable fit with the bigger players, does not mean that the smallest enterprises cannot benefit from using them nor that they are inherently insecure.

This brings me to the second category: the password naysayers who want to sell you on some other method of authentication and access control. This second group will often use the 'all your eggs belong to us' argument. In that, putting all your passwords in one place creates a very attractive target for hackers.

I agree. If there was a compromise, it would be disastrous. Just like it would be if that small business was re-using passwords across services and one of them suffered a breach. Just like if the passwords being used were not strong enough to resist attempts to crack them. Just like so many data breach scenarios involve passwords.

Would I rather see every enterprise adopt tokenisation, multi-factor authentication method? Of course I would, but that ain't going to happen at the bottom of the enterprise sizing graph where money, time and technical knowledge are all too often in short supply.  

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

The most significant challenges facing SMBs post-pandemic
SMB

The most significant challenges facing SMBs post-pandemic

7 Jul 2021
Help to Grow: Government responds to SMB SOS
SMB

Help to Grow: Government responds to SMB SOS

18 Mar 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Square to acquire Afterpay for $29 billion
mergers and acquisitions

Square to acquire Afterpay for $29 billion

2 Aug 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021