How Reusing Passwords Is Hurting Your Business

By Michael Greene

Michael Greene

Security hygiene is an increasingly important factor in today’s heightened threat environment when companies are vetting technology providers, MSPs and others in the channel. These groups are investing significant sums of money to strengthen security to protect their data and their clients, yet there is a critical area that is often overlooked: password reuse and the sharing of passwords between personal and work accounts.

The average person knows better than to reuse passwords across multiple work and personal related sites, but the human desire for convenience and efficiency will trump this knowledge every time. For example, 91% of respondents in a LogMeIn survey claim to understand the risks of reusing passwords across multiple accounts, but 59% admitted to doing it anyway. What’s more, 62% of employees are reusing the same password for both work and personal accounts.

There is a staggering amount of breach data on the internet and Dark Web and with attacks occurring on a continuous basis, this treasure trove for hackers is only growing. I recently spoke with a company that discovered that 4% of its uncompromised credentials become compromised within one month and this happened month over month. All a cybercriminal needs to do is obtain an exposed credential from one breach and use those same credentials to access other sites and systems. With the rampant practice of password reuse, it won’t be long before the hacker is able to access sensitive accounts and information.

For channel partners, this practice represents a serious security vulnerability. MSPs have emerged as a top target for hackers, with the U.S. Department of Homeland Security’s Computer Emergency Readiness Team (US-CERT), issuing an alert warning companies of advanced persistent threat activity. In addition to the typical headaches associated with data breaches — financial repercussions, brand impact, loss of sensitive data — MSPs and other groups in the channel face the added pressure of fallout from the client and vendor community. For many, this pressure will be too much to withstand — one study found that 60% of small businesses fold within six months of experiencing a breach.

What Can Channel Companies Do?

Organizations have historically addressed compromised passwords by implementing mandatory password resets every 42 to 90 days following the recommendations of traditional guidelines. However, times have changed as both the National Institute of Standards and Technology (NIST) and Microsoft have recently come out against password expiration for a number of reasons:

With awareness growing of these and other issues associated with expiring passwords, organizations must now focus on securing employee accounts from the start. Many companies in the channel have high employee turnover, and it’s important to be conscious of poor password practices that might follow your new hire from their prior position. Researchers from Virginia Tech University found that more than 70% of users employed a compromised password for other accounts up to a year after it was initially leaked, with 40% reusing passwords which were leaked over three years ago. This underscores that companies must expect poor password hygiene from their users and revise password policies accordingly.

NIST recommends that companies now verify …

… that passwords are not compromised before being activated and on an ongoing basis. By checking proposed passwords against a database of known, exposed passwords, channel companies and MSPs can obtain much more accurate and real-time protection while also eliminating the resource and financial burden of password complexity.

Of course, with new breaches occurring constantly, it’s highly likely that a password might be secure at its creation but become compromised down the road. As such, it’s also critical that channel companies have an automated, ongoing ability to check password security against a database updated daily rather than a static list of exposed credentials. Should a compromise be detected, it’s important to institute an immediate automated action to secure the account before additional damages can occur.

It’s unrealistic for companies to expect password reuse to change on its own, but it’s also untenable for them to continue to allow the use of exposed credentials. Channel organizations and MSPs can invest in countless cybersecurity solutions but, if employees or stakeholders continue to use weak or compromised credentials, these companies will continue to fall prey to attacks. Implementing an automated way of continuously ensuring password security will drive down help desk costs, increase productivity and ensure much greater account security.

For channel companies competing in crowded markets, this approach not only protects existing clients but also provides a security advantage when going head-to-head in deals. As such, it’s essential that organizations act to reduce risk and stay ahead of the competition.

Michael Greene is CEO of Enzoic, a leading provider of compromised credential screening solutions. Prior to Enzoic, he was the CEO of ID Watchdog, an identity theft protection company that was sold to Equifax in 2017. He’s also held senior management positions at Symantec, Webroot, Thompson Micromedix, Raindance and Baxter. He earned an MBA and a bachelor’s degree in biology from the University of Colorado. Follow Michael on LinkedIn or @EnzoicSecurity on Twitter.