Securing Organization’s Cyberspace – Step 3

Step 3 – Eliminate weak passwords, ideally by implementing multi-factor authentication (MFA). Going passwordless is a security upgrade your employees will actually appreciate.

Up to 63% of users recycle the same login credentials across multiple applications. To make matters worse, the quality of these passwords is often completely inadequate. Commonly used passwords like 123456, admin, password, or mom123 can be cracked by hackers in a fraction of a second. Modern password-cracking software and high-performance processors can test billions of combinations per second, rendering simple passwords entirely useless.

To provide real protection, a strong password must be at least 12 characters long and include a mix of numbers, uppercase and lowercase letters, and special characters. Under no circumstances should users utilize their own names, simple dictionary words, predictable sequences, or known entities like sports teams. Furthermore, modern cybersecurity frameworks (such as NIST guidelines) no longer recommend forcing users to change their passwords every 90 days, as this practice predictably leads to users simply adding sequential numbers to old passwords.

However, requiring complex, unique login credentials for every single application exhausts users. Employees find password management tedious and frequently resort to writing them down on sticky notes attached to their monitors or hidden under keyboards. In larger organizations, this creates a massive security vulnerability. Malicious actors can easily pose as couriers or external contractors, infiltrate the office, and steal these credentials. The risk multiplies when employees carry laptops with passwords taped to them into public spaces. A quick coffee shop visit or a brief distraction at a conference can easily lead to a devastating data breach.

What questions should you ask?

Have we established policies that genuinely help employees use strong, unique authentication methods? Are we relying on outdated password expiration rules that frustrate users? How can we eliminate the temptation to write down or share passwords? What concrete benefits would multi-factor or passwordless authentication bring to our daily operations?

Why?

Preventing the theft of digital identities is the absolute foundation of securing company data, internal know-how, and sensitive client documents. Multi-factor authentication (MFA)—and ideally a passwordless approach—introduces a non-transferable security element into the login process, such as a physical smart card or a secure mobile app. With passwordless authentication, the login is typically authorized via biometrics or a short, one-time PIN. By eliminating the need to invent, memorize, and regularly rotate complex passwords, this method is highly appreciated by employees. Despite delivering a significantly higher level of enterprise security, the daily login process becomes vastly simpler and faster.