Everyone is deeply bound to multiple devices and services, each with its own identity access point and password. Reusing passwords is a matter of necessity, and some hackers exploit these redundant credentials to easily achieve malicious account access.

To avoid falling into password silos, many users turn to password managers to manage profiles of different passwords. But even password managers struggle to withstand the unethical behavior of hackers.

Password managers have a weakness at their core: the passwords themselves. Once a manager is compromised, malicious actors hold the keys to the user's kingdom.

Passwords may be the worst-case scenario in cybersecurity. More secure authentication solutions are emerging, but given how frequently passwords are the root cause in cyberattacks, their adoption is still too slow, says Phil Dunkelberger, CEO of Nok Nok Labs. Nok Nok Labs is a founding member of the FIDO Alliance, which promotes industry collaboration for stronger authentication.

Are passwords the sole cause of data breaches? Absolutely not, but due to their 'fragility,' passwords remain a 'significant part of the problem,' Dunkelberger points out. Once a privileged user's credentials are stolen, 'hackers can easily elevate their privileges,' especially when credentials are linked to single sign-on systems.

When Password Managers Are No Longer Trustworthy

Security vendor breaches are noteworthy, but cases where vendors are hacked and customers suffer have become a persistent trend.

Password management systems 'are attractive targets because the credentials stored within can be used to attack multiple systems,' and stolen credentials can be retained for subsequent attacks, says Merritt Maxim, principal analyst at Forrester.

In an ideal world, password managers would be enough to thwart hackers' malicious activities. But hackers are cunning, and the effectiveness of perimeter defenses is ultimately limited.

To avoid falling into password silos, many users turn to password managers to manage profiles of different passwords.

Therefore, even if a password manager's single access key were made of 'Teflon'-like indestructible material, it would not be immune to hackers' cunning. The 2015 breach of the LastPass password manager is a case in point.

According to LastPass, the company confirmed the breach after detecting unusual activity on its network, ultimately discovering that user emails, password reminders, per-user salts, and authentication hashes had been compromised.

To hold the 'fortress,' the company successfully thwarted the attack and avoided the exposure of encrypted data, including user-set master passwords.

Nevertheless, the company urged customers to change their master passwords after the breach, but the individual passwords associated with the master key could remain unchanged.

Although this was nearly a nightmare, the LastPass incident should not lead enterprises to abandon some form of password management.

When Passwords Are Weak Like '123456'

Maintaining password hygiene is exhausting, and for many, password management alleviates this burden, especially in an increasingly threatening landscape.

According to a Forrester report, nearly one-third of cyberattacks are carried out through stolen credentials. Some U.S. organizations spend over $1 million annually on password management support costs alone, including specialized personnel and infrastructure.

However, 42% of employees try to remember passwords by heart without storing them, while 17% write passwords down in notebooks. These two methods are the most common forms of personal password management.

When the only line of defense against a data breach is a sticky note with a password, enterprises have every reason to reassess their password management strategies.

Even if a password manager's single access key were made of 'Teflon'-like indestructible material, it would not be immune to hackers' cunning.

Moreover, insider threats always exist. In the past year, nearly a quarter of breaches originated from insider attacks, with 50% involving abuse or illegal purposes.

'Even if passwords are stored in encrypted form, directory administrators theoretically have above-average access privileges, and if they harbor malicious intent, they could obtain user credentials for internal theft or other fraudulent activities,' Maxim says.

When the Threat Comes from Within

To prevent corrupt employees from accessing data they could easily obtain, audit or logging tools can be used to monitor whether administrators attempt to download authentication caches.

But known cyberattacks, such as Not Petya, have used password guessing as a highly effective tool.

'In the old days of IT, password cracking required brute-force computing, meaning a large number of servers to attempt to crack encrypted passwords,' Maxim says.

Now, hackers are using rainbow tables. 'Given a range of known commercial encryption algorithms used to hash passwords, hackers have precomputed encrypted hashes for thousands of password combinations,' without needing 'brute force,' Maxim adds.

With just a web browser and a rainbow table, hackers can steal 'encrypted password data dumps,' find matching text, and reverse-engineer passwords. But this password-cracking method is most effective when passwords are based on dictionary words.