Why cloud security is only as strong as your weakest password (and what you can do about it)
Fran Rosch
Your personal and professional security is only as strong as your weakest password. And for IT managers, the security of an organization's cloud-based resources is only as strong as your most careless employee's weakest password.
Personal information can be harvested many ways – and the viability of traditional usernames and passwords are undermined by the “forgot your password” processes employed by many sites today. Many hacks have been successful because of harvested information used to break the confidence of such “reset” measures and then scouring accounts for professional account login information.
The industry must move to stronger authentication technologies. After all, the strength of a password is meaningless if someone can reset your password. The primary mechanism for secure access to web services is embarrassingly inadequate. In fact, the migration of IT to the cloud may mark the death of the traditional username and password and drive the adoption of stronger internet security measures.
Stronger authentication is available in the form of two-factor authentication, such as one-time password solutions. These solutions can – literally -- put stronger security in the hands of every individual: Plastic tokens, USB drives, SMS-enabled devices or software running on mobile devices.
Such solutions have been available for years for enterprise implementations, but cost issues tied to scaling these solutions to large numbers of users have been prohibitive.
By delivering two-factor authentication through a managed service, however, the expensive infrastructure investments of on-premise models may not present as intimidating a barrier. Such a service can dramatically reduce fixed and operating costs of ownership. And a mobile device can dramatically simplify deployment.
Ironically, or not so ironically, Authentication-as-a-Service (AaaS) – strong authentication delivered through the cloud – could be a major solution for the cloud paradigm's most obvious security challenge.
Reckless human behavior is something you can influence but can't ultimately control. Additionally, people live their digital lives across personal and private online accounts. But two factor authentication can be implemented across professional and personal accounts – from the free email account to the cloud-based ERP account – to ensure that password vulnerabilities are a thing of the past and that cloud-based services are secure in the future.
