Cybersecurity has a fundamental flaw. For the past sixty years, passwords and credentials have been the most common means of controlling access, but they are unreliable and insufficient to support an effective defense system, a source of long-standing frustration within the industry.

Netenrich CISO Chris Morales points out that access control has always followed a somewhat archaic old model, and he personally despises passwords.

"We invest a lot of money and do many cool things, but the entire security system can collapse due to one bad password," he said.

Morales further explains: "The problem is that access is 'all or nothing,' and passwords fall into the category of 'what you know.' Once you know a secret, you are considered trusted and can then access everything." This binary mechanism is the root of the problem.

Cybersecurity Dive interviewed more than thirty-six cybersecurity leaders, who generally believe that the access control system is severely broken. However, in its most common current form, enterprises cannot function without passwords and identities. This problem is not new—it predates the internet. Poor identity governance is a chronic condition.

MK Palmore, Director of the Google Cloud CISO Office, told Cybersecurity Dive: "I think in some cases, identity is the core of the entire game."

Credential proliferation

If access is the cornerstone of the system structure, then passwords are the 'connective tissue' holding everything together. Enterprises typically use thousands of applications and services to accomplish tasks. According to Forrester data,large enterprises use an average of 367 software applications and systems. Although single sign-on is becoming more common, each application is often still tied to a set of usernames and passwords.

The proliferation of credentials has spawned a vast identity and access management (IAM) ecosystem, including password managers, single sign-on services, multi-factor authentication (MFA), and other tools designed to verify identity and enforce permissions.

"We invest all our money and effort, but the entire security can collapse due to one bad password."

— Chris Morales, CISO at Netenrich

Cybersecurity experts are often reluctant to publicly question the effectiveness of password managers or MFA, because these tools, despite their flaws, still enhance an organization's security posture. They simplify user access but also concentrate risk within the organization. Several high-impact attacks over the past year serve as cautionary tales.

Thesustained attack on LastPasswent undetected for months and eventually became one ofthe most notable security failures of 2022: an unidentified threat actor stole cloud backups containing all customer vault data, including encrypted passwords and usernames. The incident highlighted the core dilemma facing defenders.

Phishing and the use of stolen or compromised credentials remainthe two most common attack vectors, according to IBM Security'sCost of a Data Breach Report, accounting for three out of ten breaches.

LastPass CEO Karim Toubba believes that credential manipulation and credential-based attacks are a crisis. "Due to the type of data we hold, we are destined to be 'fat targets' for attackers for a long time," Toubba told Cybersecurity Dive.

LastPass is not alone. Single sign-on providerOkta suffered a phishing attack last year, had abreach incident, and experiencedthe theft of GitHub source code. Twilio's popular two-factor authentication service was also breached last summer aftermultiple employees were trickedinto providing credentials.

Michael Sikorski, CTO and VP at Palo Alto Networks Unit 42, said: "Once you centralize, you give attackers a prime target. The crown jewels are all in one place."

Identity abuse erodes system integrity

Authentication flaws fuel cyberattacks; when unauthorized users gain access, bad things can happen. Once threat actors gain seemingly legitimate access to enterprise systems, they can cause various damage—data theft, ransomware, and extortion activities.

Andrew Shikiar, Executive Director of the FIDO Alliance, said: "The vast majority of these breaches and attacks stem from weak knowledge-based credential authentication, especially user authentication and passwords." He added: "The fundamental problem is the primary authentication factor—the password. We have relied on this inadequate method of user authentication for 60 years."

The 'approve or deny' binary mechanism used by passwords is the crux of the problem. Cloudflare CEO Matthew Prince said that access control may not be the first line of defense in every scenario, but "it is the most important line of defense because it makes all other security challenges much more manageable."

Credential trading is active on the dark web. According to IBM Security X-Force data, credentials account for nearly 90% of assets for sale on the dark web,with an average listing price of nearly $11 each. For cybercriminals, the potential returns from obtaining these credentials through phishing and data breaches are extremely lucrative.

According to Verizon'sData Breach Investigations Report, stolen credentials are the most common entry point for breaches. CrowdStrike research shows that over the past year,four out of five breachesinvolved threat actors exploiting compromised identities. Threat actors also use valid account credentials to attack critical infrastructure. According to the Cybersecurity and Infrastructure Security Agency (CISA), in fiscal year 2022,more than half of attacks against critical infrastructure organizationsused valid credentials.

System access and identity are critical, and both attackers and defenders know this. Darren Guccione, CEO and co-founder of Keeper, said: "Identity and access management is the most important component of cybersecurity because it is the core of cybersecurity. Everything starts here."

Organizations can limit risk through design

In the short term, limiting identity risk may be more realistic than completely eliminating passwords, but this depends on permission management, which is also challenging. John Dwyer, Research Director at IBM Security X-Force, noted that access to IT infrastructure remains overly broad, and privileged accounts are often granted without careful consideration. Ransomware succeeds because threat actors exploit this flat architecture. However, "throughout my entire career, the best practice has been not to do the right things," Dwyer said.

Kelly Shortridge, Senior Principal Engineer in Fastly's CTO Office, believes that managing permissions for system access, while complex, should be considered one of the new foundations of cybersecurity. Organizations that follow this practice can design systems to limit the damage attackers can do after obtaining developer credentials andshift defense strategies toward resilience. Shortridge said: "Failure is inevitable and happens all the time. We need to be prepared to handle it calmly and adapt to changing circumstances."

Cybersecurity authorities acknowledge the benefits of IAM but also warn organizations about the many issues exposed in these strategies and tools. According to CISA and the National Security Agency (NSA), identity governance and alignment, infrastructure hardening, MFA, and monitoring canprevent some of the most likely threats. CISA'svoluntary cybersecurity performance goalsalso encourage organizations to reduce account security risks by changing default passwords, separating user and privileged credentials, revoking unnecessary access, supporting MFA, and requiring long, unique passwords.

However, combining these recommendations with recognized best practices like password managers and single sign-on, while addressing the real threat landscape, remains difficult for defenders. Jaya Baloo, CSO at Rapid7, said: "We have made the process of integrating all these different technologies extremely complex."

When security incidents occur,unimplemented security fundamentals—such as properly managing credentials—keep recurring. Palmore said: "In many cases, we still haven't done the basics. Many organizations haven't even gotten the basic 'block and tackle' right."

The slow march toward a passwordless future

Efforts to expand access encryption and rid the world of passwords are underway, but change is difficult and the task is enormous.Phishing-resistant MFAsolutions, which rely on cryptographic technologies such as asymmetric public/private key pairs, biometrics, or the FIDO2 standard, can provide a higher level of assurance. Thepasswordless standard developed by the FIDO Alliance(also known as 'passkeys') is also gaining support and momentum.

Shikiar said: "Almost every company you would want to work with on solving the password problem is working together in this alliance." The scale of the challenge is enormous, requiring unified industry support, capabilities across all endpoints, development at the application and service level, and widespread user adoption.

Several CISOs interviewed by Cybersecurity Dive said they intend to move toward passwordless authentication in their organizations. However, because many critical systems currently do not support—and may never support—this authentication protocol, the path to passwordless will have to wait for updated versions of technology and infrastructure. Gary Barlet, Federal Field CTO at Illumio, said: "I'm not sure we can 100% reach a point where we are absolutely confident that identities accessing the enterprise and its information are absolutely reliable." He added: "I try to live in the real world, not the ideal world."