Why businesses still get password management wrong | TNW Deals

Compromised passwords are the most common entry point for attackers, accounting for over 80% of hacking-related breaches. Weak passwords are rarely the main cause; failures occur in how credentials are stored, shared, rotated, and governed across organizations. Personal password managers can generate unique credentials, autofill them, and encrypt a vault with a master password. Enterprise needs add requirements such as secure credential sharing, instant revocation for departing employees, and audit trails for compliance frameworks like SOC 2, HIPAA, and PCI DSS. Organizations also must manage SSH keys, API tokens, database credentials, and privileged session access. Many tools focus on storage and autofill rather than governance.

"Compromised passwords remain the single most common entry point for attackers, responsible for over 80 per cent of hacking-related breaches according to Verizon's annual data breach report. The issue is rarely that people choose weak passwords. It is that the systems around those passwords, how they are stored, shared, rotated, and governed, are fundamentally broken in most organisations."

"For individuals, the calculus is simple. A good password manager generates unique credentials for every account, fills them automatically, and encrypts the vault with a master password only you know. The market has plenty of decent options for this use case. But the moment you move beyond a single user, the complexity multiplies."

"Teams need to share credentials without exposing them in plaintext. Departing employees need to have their access revoked instantly, across every system. Compliance frameworks like SOC 2, HIPAA, and PCI DSS demand audit trails showing who accessed what, when, and from where. And increasingly, organisations need to manage not just passwords but SSH keys, API tokens, database credentials, and privileged session access."

"This is where most password managers hit their ceiling. They were built to store and autofill credentials. They were not built to govern them. Why credential governance matters more than credential storage Consider a typical mid-sized company. Marketing has a shared Google Ads login saved in a spreadsheet."

Read at TNW | Data-Security