Victor Sigismondi, Author at Photos Not Passwords for Secure Login Authentication

In the daily operations of a business, it’s normal for employees to need to access multiple accounts or collaborate across accounts to get their work done. In some cases, though, it may be impractical to have multiple accounts for the same service. When this happens, it’s common for employees to share passwords.

Password sharing in a business setting can be dangerous, exposing sensitive company information to outsiders who may use it for ill intent. There are a few ways you can mitigate this danger, but first, it’s best to understand why password sharing happens and what exactly those dangers are.

Why do people share passwords?

According to research conducted by popular survey company Survey Monkey, an estimated 32 million employees in the United States share passwords. But why? Per the respondents to this survey, most people who share their passwords (about one-third of participants), at least in a work setting, do so to collaborate with their teammates. Other reasons found in the survey included following company procedures and reducing costs.

This makes sense; a company may not have the resources to pay for separate subscriptions to certain services for all of their employees or may not use the service enough to justify the extra cost. Having some employees share a single paid account might be more practical in these scenarios. Additionally, having everyone work from the same account can make collaboration easier by allowing employees to save their work to the same location and access others’ work as needed without the intermediary steps of sharing documentation through messaging or emails.

The dangers of sharing passwords

The first and most obvious risk of sharing passwords is that of the person with whom the password is shared being a bad actor. Phishing schemes are incredibly common, accounting for 3.4 billion spam emails sent every day and being the most common cause of data breaches. These scams rely on a person voluntarily sharing their password with a party pretending to be some kind of authority.

Even if the person with whom you are sharing your password is not a bad actor themselves, however, password sharing can still lead to accessing sensitive information through unsecured networks. It is incredibly difficult to regulate server access if employees share information and access it via external networks such as remote office setups or public computers.

Additionally, if any changes are made to the sensitive data via an external network, tracking who made the changes and why is much more difficult. This may mean that your internal data is susceptible to abuse by jaded former employees or dishonest employees looking to profit from your work in some way. This may mean anything from unauthorized social media posts that may greatly damage the company image to the misuse of customer information to potential serious loss of revenue.

How to share passwords safely

All of this being said, there will still be scenarios in which you may need to share an account across multiple employees or access points. Here are some tips from Forbes on how to share passwords safely.

It’s also a good idea to implement multi-factor authentication into all of your accounts. MFA adds layers of security to accounts and limits access to those with the appropriate information and identifying factors. Consider adding a more advanced MFA solution such as Photolok to your data. Photolok, a new technology from Netlok, allows users to upload and label photos to be used as identifiers; they simply select their photo from a grid to access their account. There is also an option to create a Duress photo, which will allow access for the user in the event of a forced authentication but will also alert the appropriate authorities so that the breach can be addressed quickly and safely.

Why MFA Is Important to Keeping Your Business Safe

If you are a business looking to implement MFA, consider using a more advanced authentication method such as Photolok IdP. Photolok is a passwordless IdP that is simple, effective, and offers a range of benefits including AI and ML defense, device authorization, and one-time-use authenticators. With Photolok, users select images and label them for security use. When accessing a network, application, and/or API, users simply choose their account photos in several photo panels, and they are given access. Users can also label a photo as Duress, which acts as a silent alarm. The Duress option allows the user access but notifies IT administrators that the user’s account is compromised and they need to execute the company’s security procedure quickly to protect the company and the user’s safety.

With the Biden Administration announcing new guidelines for AI safety – including requiring innovators to share critical information with the federal government – it is clear that cybersecurity stakeholders must also defend against the serious threat AI poses to online security, privacy, and data protection.

Fortunately, Photolok IdP is available today and has been tested and found to protect against AI attacks. Photolok, a passwordless IdP, employs photos in place of passwords and uses OAuth for authentication and Open ID Connect for integration. To understand Photolok and how it protects against AI attacks, it is important to understand how AI/ML tools and techniques have made it easier for hackers to get around current password security methods.

AI/ML tools are enabling hackers to scrape the internet for personal data and find passwords. When combined with social engineering, AI technics can decipher passwords far more quickly than earlier systems. The reality is that AI password crackers can breach most passwords in seconds and more difficult ones in minutes. For example, hackers can attempt millions of possible passwords each minute using AI-driven brute-force attacks that enable hackers to take advantage of password complexity flaws. While longer passwords and phrases make it more challenging, as computational capabilities of AL and ML continue to evolve, those solutions will experience a significant reduction in efficacy.

AI technologies are also negating the cybersecurity value of two-factor authentication. For example, the common use of CAPTCHAs, known as Completely Automated Public Turing test to tell Computers and Humans Apart, are becoming obsolete. AI bots have become so adept at mimicking the human brain and vision that CAPTCHAs are no longer a barrier.

Making CAPTCHAs more complex is not the answer. Cengiz Acartürk, a cognition and computer scientist at Jagiellonian University in Kraków, Poland, says that there’s a problem with designing better CAPTCHAs because they have a built-in ceiling. “If it’s too difficult, people give up,” Acartürk says. Whether CAPTCHA puzzles are worth adding to a website may ultimately depend on whether the next step is so important to a user’s experience that a tough puzzle won’t turn away visitors while providing an appropriate level of security. AI bots are better than humans at solving CAPTCHA puzzles (qz.com)

Another way AI undermines passwords is via the use of keylogging. The use of AI can enable keyloggers to keep track of your keystrokes in order to retrieve your passwords. According to a University of Surrey study, artificial intelligence can be trained to recognize the key that is being pressed more than 90% of the time simply by listening to it. Using an Apple MAC Pro, the group recorded the sound of 25 distinct finger and pressure combinations being used to press each key on the laptop. The noises were captured during a conversation on a smartphone and during a Zoom meeting. A machine learning system was then trained to recognize the sound of each key using some of the data that had been provided to it. The algorithm was able to accurately identify which keys were being pressed 95% of the time for the call recording and 93% of the time for the Zoom recording when it was evaluated using the remaining data. What secrets can AI pick up on by eavesdropping on your typing? (govtech.com)

To combat these attack vectors, Photolok randomizes photos to mediate AI/ML attacks so that AL/ML tools cannot identify and/or learn any patterns, which prevents AI/ML breaches. Photolok uses steganographic photos (random codes hidden in the photo) to hide the attack points from nefarious hackers, while randomly placing the user’s photo on each photo panels to prevent keylogging and other security attack methods. Photolok also blocks horizontal penetrations and defends against external threats, such as ransomware, phishing, shoulder surfing, and man-in-the-middle assaults.

Traditionally, strong passwords have been a first-tier defense against cyber-attacks and breaches. However, with the development of AI and ML tools, the effectiveness of cyber-defense has been thoroughly diminished, especially from more sophisticated cyber actors who use AI/ML tools to circumvent password defenses. Despite the drawbacks of passwords, cyber decision-makers (CTOs, CISOs, etc.) have been hesitant to abandon them. But an innovative passwordless solution is available that can facilitate that change from passwords and enhance security strategies. It’s Netlok’s Photolok, a passwordless IdP, which employs images in place of passwords and uses OAuth for authentication and Open ID Connect for integration.

Photolok is user-friendly and provides enhanced security not available with other solutions. Photolok’s randomization of photos mediates AI/ML attacks because they cannot identify and/or learn any patterns and, therefore, prevents AI/ML breaches. The proprietary photos are used to hide attack points from nefarious actors, streamline the login process, and make point-and-click navigation easy to use.

With Photolok, bots are unable to recognize which photographs to attack. Any automated attack is substantially neutralized by the randomization of photo localizations. Moreover, the digital information hidden behind the images—which can be updated every time a login attempt is made—won’t be gathered by the bots. Any automated bot attempt to get access will certainly fail and result in the user’s account being instantly locked out.

Photolok makes the identity authentication journey easier for humans to manage. The photos are easy to remember, connect with people, and provide privacy protection. Photolok’s simplicity makes it intuitive and removes language and literacy barriers that make passwords difficult to operate. Getting rid of passwords also eliminates the costly process of password resetting and following password rules, which makes Photolok very cost-effective. To change and/or add new photos, users select and label a photo that are automatically saved in seconds.

Photolok IdP is an identity provider and an authentication server with Open ID Connect making it easier to integrate apps and APIs. With Photolok, users upload pictures from Photolok’s custom library to be used as identifiers. To authenticate their identity, the user just uploads, labels, and chooses security photos from Photolok’s custom library.

Photolok IdP can be used as a standalone MFA alternative. The availability of robust authentication techniques like multi-factor authentication (MFA) can greatly lower the risk of data loss or compromise and is one of the main benefits of adopting an identity provider (IdP). Photolok MFA IdP can confirm the user’s identity, making it more difficult for malicious parties to access private information without authorization.

Deploying single sign-on (SSO) technology also simplifies the user experience, which is another advantage of adopting an identity provider like Photolok. When used with a federator like Okta Workforce, users won’t need to remember numerous passwords, usernames, or backup authentication techniques, which lowers the total quantity of data that a business’s system must constantly monitor. For example, Netlok uses Photolok to login to its Okta Workforce account to immediately access a wide pool of apps and APIs.

Photolok is the first IdP to offer situational security protection in the public environments or even in unprotected remote work. The Photolok account owner can 1) Give permission for the device and browser to be used for Photolok identity and authentication entry, 2) Utilize the “Duress” photo to trigger an automated warning informing the IT that the account owner is having problems or that a malicious actor is forcing them to access their device, 3) Utilize the “One-Time Use” photo to stop shoulder surfing, and 4) Give permission for the alert message to be sent each time the user opens their account. Photolok is a major innovative development in digital security systems, particularly in its capabilities to mitigate AI generated threats. Photolok effectively removes a great deal of the shortcomings in the current security paradigm. More significantly, Photolok blocks horizontal penetrations and defends against external threats, such as ransomware, phishing, keylogging, shoulder surfing, and man-in-the-middle assaults. In effect, Photolok lessens the user’s burden while improving online digital security, which is essential for widespread adoption by both businesses and consumers.

The National Security Agency (NSA) and partners have identified indicators of compromise (IOCs) associated with a People’s Republic of China (PRC) state-sponsored cyber actor using living off the land techniques to target networks across U.S. critical infrastructure.

“Cyber actors find it easier and more effective to use capabilities already built into critical infrastructure environments. A PRC state-sponsored actor is living off the land, using built-in network tools to evade our defenses and leaving no trace behind,” said Rob Joyce, NSA Cybersecurity Director. “That makes it imperative for us to work together to find and remove the actor from our critical networks.”

• U.S. Cybersecurity and Infrastructure Security Agency (CISA)
• U.S. Federal Bureau of Investigation (FBI)
• Australian Cyber Security Centre (ACSC)
• Canadian Centre for Cyber Security (CCCS)
• New Zealand National Cyber Security Centre (NCSC-NZ)
• United Kingdom National Cyber Security Centre (NCSC-UK)

“For years, China has conducted operations worldwide to steal intellectual property and sensitive data from critical infrastructure organizations around the globe,” said Jen Easterly, CISA Director. “Today’s advisory, put out in conjunction with our US and international partners, reflects how China is using highly sophisticated means to target our nation’s critical infrastructure. This joint advisory will give network defenders more insights into how to detect and mitigate this malicious activity. At the same time, we must recognize the agility and capability of PRC cyber actors, and continue to focus on strong cybersecurity practices like network segmentation and ongoing investments in promoting the resilience of critical functions under all conditions. As our nation’s cyber defense agency, CISA stands ready to aid any organization affected and we encourage all organizations to visit our webpage for guidance and resources to make their networks more resilient.”

“The FBI continues to warn against China engaging in malicious activity with the intent to target critical infrastructure organizations and use identified techniques to mask their detection,” said Bryan Vorndran, the FBI’s Cyber Division Assistant Director. “We, along with our federal and international partners, will not allow the PRC to continue to use these unacceptable tactics. The FBI strives to share information with our private sector partners and the public to ensure they can better protect themselves from this targeted malicious activity.”

“It is vital that operators of critical national infrastructure take action to prevent attackers hiding on their systems, as described in this joint advisory with our international partners,” said Paul Chichester, NCSC Director of Operations. “We strongly encourage UK essential service providers to follow our guidance to help detect this malicious activity and prevent persistent compromise.”

“The Canadian Centre for Cyber Security joins its international partners in sharing this newly identified threat and accompanying mitigation measures with critical infrastructure sectors,” said Sami Khoury, Head of the Canadian Centre for Cyber Security. “The interconnected nature of our infrastructures and economies highlights the importance of working together with our allies to identify and share real-time threat information.”

The CSA provides an overview of hunting guidance and associated best practices. It includes examples of the actor’s commands and detection signatures. The authoring agencies also includes a summary of indicators of compromise (IOC) values, such as unique command-line strings, hashes, file paths, exploitation of CVE-2021-40539 and CVE-2021-27860 vulnerabilities, and file names commonly used by this actor.

As one of their primary tactics, techniques, and procedures (TTP) of living off the land, the PRC actor uses tools already installed or built into a target’s system. This allows the actor to evade detection by blending in with normal Windows systems and network activities, avoiding endpoint detection and response (EDR) products, and limiting the amount of activity that is captured in default logging configurations.

NSA recommends network defenders apply the detection and hunting guidance in the CSA, such as logging and monitoring of command line execution and WMI events, as well as ensuring log integrity by using a hardened centralized logging server, preferably on a segmented network.

Defenders should also monitor logs for Event ID 1102, which is generated when the audit log is cleared.

The behavioral indicators noted in the CSA can also be legitimate system administration commands that appear in benign activity. Defenders must evaluate matches to determine the significance, applying their knowledge of the system and baseline behavior.

A new survey of government office workers across the world found that “digital natives” — those who grew up with modern technology — are actually more likely than older employees to exhibit bad password habits.

For those who grew up with smartphones, technology tends to come naturally — except when it comes to password hygiene, apparently.

A new report from the cybersecurity and IT asset management company Ivanti, in which it surveyed about 800 government office workers across the world, found that younger employees were more likely to use the same or similar passwords for multiple devices or accounts. They were also more likely to share passwords between personal and work accounts.

The survey also found that those in leadership positions demonstrated worse cyber hygiene than others. They were more than four times as likely to have clicked on a phishing link and five times as likely to share passwords with people outside their organization. Leaders also take longer to change passwords and use easy-to-find information such as birthdays in their passwords, according to the report.

Other findings from the survey:

Respondents rated the complexity of their organizations’ tech stacks as the single biggest barrier to security excellence, followed closely by a lack of cybersecurity skills.
Only 61 percent of respondents worldwide said their organizations mandate cybersecurity training; in the U.S. that rises to 78 percent.
Half of respondents reported that their organizations were entirely or mostly in-office, with the rest engaging in some mix of remote work. The percentages were mostly consistent between the U.S. and global average.
Nearly half of security professionals said they lack high visibility into all users, devices, applications and services on their networks.

Cybersecurity Ventures released a new report that claims cybercrime is going to cost the world $8 trillion in 2023. If it were measured as a country, then cybercrime would be the world’s third largest economy after the U.S. and China.

The number sounds outlandish, but they stated: “We expect global cybercrime damage costs to grow by 15 percent per year over the next three years, reaching $10.5 trillion USD annually by 2025, up from $3 trillion USD in 2015.

“Cybercrime costs include damage and destruction of data, stolen money, lost productivity, theft of intellectual property, theft of personal and financial data, embezzlement, fraud, post-attack disruption to the normal course of business, forensic investigation, restoration and deletion of hacked data and systems, and reputational harm.”

The 2022 Official Cybercrime Report published by Cybersecurity Ventures and sponsored by eSentire, provides cyber economic facts, figures, predictions and statistics which convey the magnitude of the cyber threat we are up against, and market data to help understand what can be done about it.