Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Authentication

7/17/2019
02:00 PM
Maxine Holt
Maxine Holt
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
100%
0%

A Password Management Report Card

New research on password management tools identifies the relative strengths and weaknesses of 12 competing offerings.

The phrase "password management" engenders similar reactions from both those responsible for cybersecurity and the individuals who must use passwords. It's a "trying necessity."

To address the issues associated with password management, there is a good selection of tools available to teams, businesses, and enterprises. However, these products need to adapt and evolve to win new business, protect against new cybersecurity threats, and support the move toward a "password-less" enterprise. Recent research from Ovum, a UK-based analysis firm, evaluated a dozen of the most prominent players in the account credential market, assessing the relative strengths and weaknesses of 12 competing offerings. Here is a summary of our findings:

  • All products selected for the report offer good deployment and administration capabilities.
  • No single vendor stands out head and shoulders above the rest. However, based on a range of categories, the leading products are: 1Password Business, Dashlane Business, Keeper for Business, LastPass Enterprise, ManageEngine Password Manager Pro, Pleasant Password Server, and RoboForm for Business.
  • The open source products from Bitwarden and Passbolt both show strong potential and demonstrate what can be accomplished by small teams.
  • Bluink deserves a mention for its mobile-first approach to password management, especially the geofencing capabilities of Bluink Enterprise.
  • And finally, kudos to Passwork and TeamPassword for developing easy-to-use password management solutions that address the specific needs of startups and digital marketing agencies.

Advice to Enterprises: User Password Mangers & MFA
Among a range of Ovum recommendations for enterprises, adopting any trusted password manager is almost always going to be better than not adopting one at all. Our research reveals that over 80% of major data breaches can be traced back to a single compromised identity, so password management needs to be on the top of the cybersecurity agenda. Ovum also recommends that enterprises evaluate products originating in the consumer market and consider the benefits of offering password management tools that employees can extend for personal use. It could make practical sense to deploy more than one product in larger organizations.

If an enterprise is moving business and productivity workloads to the cloud, give consideration to adding strong authentication to enhance the security of employee user IDs and passwords. Password managers present an obvious target for hackers and cybercriminals, so consider which multifactor authentication mechanisms are likely to work best for staff and employees.

Security should be at the heart of any modern digital workplace strategy; therefore, password management tools must be considered alongside device, operating system, browser, and application management strategies. Microsoft and Google are introducing customers to their password-less strategies, so IT and security teams should consider the relevance of these initiatives as part of any password management-related project.

SaaS & Cloud
Organizations adopting password management products need to do their due diligence, especially if they are operating in regulated industries or where strict security protocols are in place. Be aware that it's the customer organization not the security vendor, who has responsibility for ensuring compliance with applicable laws and regulations. When considering software-as-a-service and cloud-based solutions, businesses and institutions should look for relevant vendor certifications, accreditations, and reporting standards, such as SOC 2 for trust, ISO 27001 for information security management, ISO 22301 for business continuity, PCI DSS for payment security, and ISO 27018 for protection of personally identifiable information.

The FIDO Alliance is an influential industry association from the perspective of the world’s over-reliance on passwords, and it is worth noting that Dashlane, Keeper Security, and LastPass (LogMeIn) are associate-level members. The FIDO Alliance is working to change the nature of authentication with open standards that are more secure than passwords, simpler for consumers to use, and easier for service providers to deploy and manage. That said, among its recommendations, Ovum suggests that businesses give consideration to vendors that support the FIDO Alliance in promoting a password-less future while also addressing the immediate needs of the market.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Maxine leads Omdia's cybersecurity research, developing a comprehensive research program to support vendor, service provider, and enterprise clients. Having worked with enterprises across multiple industries in the world of information security, Maxine has a strong ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8720
PUBLISHED: 2020-08-13
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
CVE-2020-12300
PUBLISHED: 2020-08-13
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-12301
PUBLISHED: 2020-08-13
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-7307
PUBLISHED: 2020-08-13
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.
CVE-2020-8679
PUBLISHED: 2020-08-13
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.