Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

7/17/2019
02:00 PM
Maxine Holt
Maxine Holt
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
100%
0%

A Password Management Report Card

New research on password management tools identifies the relative strengths and weaknesses of 12 competing offerings.

The phrase "password management" engenders similar reactions from both those responsible for cybersecurity and the individuals who must use passwords. It's a "trying necessity."

To address the issues associated with password management, there is a good selection of tools available to teams, businesses, and enterprises. However, these products need to adapt and evolve to win new business, protect against new cybersecurity threats, and support the move toward a "password-less" enterprise. Recent research from Ovum, a UK-based analysis firm, evaluated a dozen of the most prominent players in the account credential market, assessing the relative strengths and weaknesses of 12 competing offerings. Here is a summary of our findings:

  • All products selected for the report offer good deployment and administration capabilities.
  • No single vendor stands out head and shoulders above the rest. However, based on a range of categories, the leading products are: 1Password Business, Dashlane Business, Keeper for Business, LastPass Enterprise, ManageEngine Password Manager Pro, Pleasant Password Server, and RoboForm for Business.
  • The open source products from Bitwarden and Passbolt both show strong potential and demonstrate what can be accomplished by small teams.
  • Bluink deserves a mention for its mobile-first approach to password management, especially the geofencing capabilities of Bluink Enterprise.
  • And finally, kudos to Passwork and TeamPassword for developing easy-to-use password management solutions that address the specific needs of startups and digital marketing agencies.

Advice to Enterprises: User Password Mangers & MFA
Among a range of Ovum recommendations for enterprises, adopting any trusted password manager is almost always going to be better than not adopting one at all. Our research reveals that over 80% of major data breaches can be traced back to a single compromised identity, so password management needs to be on the top of the cybersecurity agenda. Ovum also recommends that enterprises evaluate products originating in the consumer market and consider the benefits of offering password management tools that employees can extend for personal use. It could make practical sense to deploy more than one product in larger organizations.

If an enterprise is moving business and productivity workloads to the cloud, give consideration to adding strong authentication to enhance the security of employee user IDs and passwords. Password managers present an obvious target for hackers and cybercriminals, so consider which multifactor authentication mechanisms are likely to work best for staff and employees.

Security should be at the heart of any modern digital workplace strategy; therefore, password management tools must be considered alongside device, operating system, browser, and application management strategies. Microsoft and Google are introducing customers to their password-less strategies, so IT and security teams should consider the relevance of these initiatives as part of any password management-related project.

SaaS & Cloud
Organizations adopting password management products need to do their due diligence, especially if they are operating in regulated industries or where strict security protocols are in place. Be aware that it's the customer organization not the security vendor, who has responsibility for ensuring compliance with applicable laws and regulations. When considering software-as-a-service and cloud-based solutions, businesses and institutions should look for relevant vendor certifications, accreditations, and reporting standards, such as SOC 2 for trust, ISO 27001 for information security management, ISO 22301 for business continuity, PCI DSS for payment security, and ISO 27018 for protection of personally identifiable information.

The FIDO Alliance is an influential industry association from the perspective of the world’s over-reliance on passwords, and it is worth noting that Dashlane, Keeper Security, and LastPass (LogMeIn) are associate-level members. The FIDO Alliance is working to change the nature of authentication with open standards that are more secure than passwords, simpler for consumers to use, and easier for service providers to deploy and manage. That said, among its recommendations, Ovum suggests that businesses give consideration to vendors that support the FIDO Alliance in promoting a password-less future while also addressing the immediate needs of the market.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Maxine leads Ovum's security research, developing a comprehensive research program to support vendor, service provider, and enterprise clients. Having worked with enterprises across multiple industries in the world of information security, Maxine has a strong understanding of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19645
PUBLISHED: 2019-12-09
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
CVE-2019-19678
PUBLISHED: 2019-12-09
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test Definition field of a new Generic Test issue.
CVE-2019-19679
PUBLISHED: 2019-12-09
In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue.
CVE-2019-19647
PUBLISHED: 2019-12-09
radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.
CVE-2019-19648
PUBLISHED: 2019-12-09
In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service (application crash) or potential code execution.