The list of the most popular passwords in 2015 will leave you shaking your head. For instance, “123456”, “password”, and “starwars” were amongst the most frequently used passwords used last year. I know we are all challenged with trying to remember complex passwords, and I’m definitely not wishing for the days when users just wrote their passwords on sticky notes and put them on their monitors, but there has to be a better way.
Before you get overly confident that your security policies prohibit brain-dead passwords like “123456” and “password” and hence you are protected, take note that there is a sharp rise in criminals using stolen credentials to access accounts. The age old trick of using social engineering to gain access to passwords is still very effective. With one set of account credentials in hand, the attacker can see what doors can be opened that might lead to opportunities to compromise your organization’s internal network and computing systems—or one of your business partner’s systems.
With account credentials a prime target, it is time to revisit multi-factor authentication (MFA) and two-factor authentication. While two-factor authentication using hardware tokens has long been required for government agencies and many enterprises, users are asking for an improved experience. Organizations today are increasingly turning to new forms of MFA to stop attackers at the network and from reaching critical applications.
Fortunately, MFA solutions are becoming more secure, easier to use and deploy, and more affordable. There’s a new generation of biometrics, including fingerprint, retina scanning and photo selection that you can use directly from smartphones and tablets, which are going mainstream. Because of this, we expect to see greater adoption of MFA in financial services, healthcare, and other sectors that are under heavy attack. In fact, analysts are predicting a 17.7 percent compound annual growth from 2015 to 2020, making MFA a $9.6 billion market by 2020.
Effective security requires an ecosystem of eyes and ears
Using authentication that’s stronger than username/password is just one piece of the security puzzle. Keeping today’s mobile workforce productive requires a security infrastructure that adapts as people use different devices and applications from different locations. Security and management tools need to be able to access and exchange relevant context and work together to ensure that security runs at the speed of business objectives.
That’s the driving force behind Aruba ClearPass Exchange, which is a core pillar of our Adaptive Trust Defense framework. The ClearPass Policy Manager provides profiling, authentication, and authorization of all users and devices and ClearPass Exchange provides the means to share contextual data among a wide range of IT systems so that all components operate as a fully integrated system to provide organizations with a coordinated defense.
For instance, ClearPass Exchange is helping us offer next generation MFA solutions in collaboration with our ecosystem partners. You can now enforce a second or even third factor of authentication based on location, device type, user, and other contextual information. The integrated workflows between ClearPass and our vendors are simple and seamless delivering a very promising user experience.
ClearPass exchange also makes it possible for our users to integrate ClearPass with firewalls to strengthen security on the edge. Integration with enterprise mobility management (EMM) systems can reveal important details about the manufacturer and model, encryption status and allowed applications on smartphones and tablets—making it possible to enforce more defined network-based policy decisions. Integration with notification systems means that IT staff is apprised of important security events by text, email or a phone call. And, security information and event management (SIEM) systems can leverage all user, device and authentication data in ClearPass to provide additional analysis and visibility.
In a later blog, I look forward to sharing more about the advanced use cases ClearPass exchange is enabling us to deliver that make it easy for our customers to integrate ClearPass with the industry’s leading security solutions.
Coming back to the topic of this note, we see strong adoption of MFA ahead. What are the plans for your organization?