--- title: Anatomy of Password-based Data protection – Part Two description: Failure of your password-based system & secure perimeters doesn't have to lead to a data breach if unauthorized persons accessing your system can’t read data. image: https://www.cloudmask.com/hubfs/featured_images/cyber-security-investment.jpg --- [![CloudMask - Data protection under breach](https://www.cloudmask.com/hs-fs/hubfs/Horizontal-larger-text.png?width=223&height=40&name=Horizontal-larger-text.png "CloudMask - Data protection under breach")](https://www.cloudmask.com) - [For Business](https://www.cloudmask.com/business) - [For Enterprise](https://www.cloudmask.com/enterprise) - [For Developers](https://www.cloudmask.com/saas-developers) - Resources - [Blog](https://www.cloudmask.com/blog) - [Videos](https://www.cloudmask.com/videos) - [Help](http://help.cloudmask.com) # Anatomy of Password-based Data protection – Part Two ![cyber-security-investment.jpg](https://www.cloudmask.com/hs-fs/hubfs/featured_images/cyber-security-investment.jpg?width=616&height=372&name=cyber-security-investment.jpg) ## Data Masking as a Solution to Password Weaknesses Password-based data protection is the most common form of data protection, but it is increasingly weak. If you think your data is secure because your organization insists on strong passwords, you are increasingly likely to be wrong. Better software tools running on powerful processors can try millions of character combinations in a short time. An article on the [Datex](https://www.datex.ca/blog/strong-or-weak-all-passwords-can-be-hacked) website is entitled, “Strong or Weak, All Passwords Can Be Hacked,” and the text explains how. But hacking passwords is not even the main weakness. Passwords can be stolen from authorized users, downloaded from servers that don’t use sufficient protection, guessed when account holders use common passwords and used repeatedly when different accounts have the same password. To achieve an acceptable level of data protection, you need additional data-centric security as a defense that prevents data breaches when password-based protection fails. ## Weaknesses of the Passwords A password only provides protection when it is kept secret, and that is becoming increasingly difficult. [Ars Technica](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/) details how hackers were able to crack passwords like “qeadzcwrsfxv1331.” It takes some effort to crack a single password and the payoff for such hacking is indeterminate, but passwords have to be stored somewhere centrally to allow the servers to check for authorization. When someone wanting access to a system enters her username and password, the system has to check the credentials against a stored list. If hackers can obtain such lists, they not only are assured of a higher possible gain; the passwords are also easier to crack. Lists of access credentials, including usernames, passwords, and other identifying information used to be stored as clear text. Recent data breaches indicate that some companies are still following this practice. Even if your lists of credentials are encrypted, once unauthorized parties get hold of them, they can usually decrypt a few of the more common passwords. Using clues from these successes, they can then decrypt many of the rest and gain access to wide variety of accounts. Failure of the password-based system automatically leads to a major data breach. ## Weaknesses Caused by Users The stronger the password, the harder it is to crack and the more difficult it is to remember. This dichotomy highlights the fact that many users will consistently choose insecure passwords that they can easily remember. Even people who possess high-value data, such as Facebook CEO Mark Zuckerberg, value convenience over security. According to [Wired](http://www.wired.co.uk/article/mark-zuckerberg-hacked-password-released), Mr. Zuckerberg’s LinkedIn, Twitter and Pinterest accounts were recently hacked, and he used the password “dadada” on all three accounts. Using a simple password on multiple accounts is convenient but insecure. The problem is not users who can’t follow instructions – it is users who can’t remember complex passwords. You can put in place policies to implement high-security passwords, rejecting simple choices automatically or assigning computer-generated character strings. Many of your employees and customers will not be able to remember them, and they will either write them down and keep them easily accessible, or they will generate a large volume of “lost” password calls to your IT support group. Even in the face of this user inconvenience and additional security overhead, hackers can still crack your complex passwords if they think it is worth their while. ## Weaknesses of the Password System The password system relies on authorization based on a user knowing his credentials, i.e. his username and password. If an unauthorized party knows authorized credentials, they can access your system, often from anywhere in the world. For information that is needed often and by a wide variety of people, your IT department will have issued many credentials. Often employees and customers are authorized to access the system and technical support personnel, business consultants and cloud services supplier personnel may also have authorized access. The system breaks down when a previously authorized user loses authorization, or an unauthorized person obtains authorized credentials. In that case, unauthorized access to data leading to a data breach becomes possible. For example, one of your employees may lose his job, but his data access is not immediately terminated. A technical support person may watch while an employee logs in and note the credentials. An authorized person might give their credentials to a friend or other employee to help out. In each case, you have potentially lost control over part of your security perimeter that the password system is supposed to maintain. The person logging in is either unauthorized, or they are not who you think they are. To maintain effective data protection, you have to add protection of the data itself in addition to maintaining a secure perimeter. ## Data Masking as a Solution to Password Weaknesses Failure of your password-based system and secure perimeters does not have to lead to a data breach if the unauthorized persons accessing your system can’t read the data. Masking is a form of encryption that is flexible, secure and easy to implement. [ITBusinessEdge](http://www.itbusinessedge.com/slideshows/using-tokenization-for-superior-data-security-02.html) describes the advantages. When your network or system security is compromised because of unauthorized access, your data is still safe because the intruders can’t read it. There is no data breach because no sensitive data is displayed. Masking is a data-centric means of protecting sensitive information and it acts as the last line of defense when your other security fails. A convenient way to implement it is to add it to your system as a [browser extension](https://cloudmask.com/get-cloudmask-action/). The extension masks sensitive information as you enter the data and before it leaves your device. Only you have the key to give access to the data. When you want to authorize someone to see the information, they will also have the browser extension installed. The software takes care of the transfer of keys, and your counterparty can read the data. For everyone else, the data remains encrypted. When you[implement Masking](https://cloudmask.com/blog/mitigating-the-risk-of-data-breaches-with-tokenization-2/), your data remains secure even when password-based security fails. You no longer have to worry about hackers cracking your passwords, users choosing bad passwords or unauthorized persons obtaining credentials. Your data remains masked until it is used and nobody, not even your own IT personnel, can read it. ![Gif Animation All.gif](https://www.cloudmask.com/hs-fs/hubfs/GIF_Animation/Gif%20Animation%20All.gif?width=640&name=Gif%20Animation%20All.gif) #### *With CloudMask, only your authorized parties can decrypt and see your data. Not hackers with your valid password, Not Cloud Providers, Not Government Agencies, and Not even CloudMask can see your protected data. [Twenty-six government cybersecurity ](https://www.commoncriteriaportal.org/)agencies around the world [back these claims.](https://www.cloudmask.com/hubfs/CloudMask_Aug2016/pdf/Common_Criteria_Cert.pdf?t=1486380970425)* ***[![TRY IT NOW](https://no-cache.hubspot.com/cta/default/468512/82253abc-9465-4974-b5ea-2a46f934181b.png)](https://cta-redirect.hubspot.com/cta/redirect/468512/82253abc-9465-4974-b5ea-2a46f934181b)*** Watch our video and demo at [www.vimeo.com/cloudmask](http://www.vimeo.com/cloudmask)  Share this article: - [Tweet](https://twitter.com/share) ### Related posts [![How to evaluate and select the best encryption services](https://www.cloudmask.com/hubfs/Lock_01.jpg)](https://www.cloudmask.com/blog/how-to-evaluate-and-select-the-best-encryption-services) [How to evaluate and select the best encryption services](https://www.cloudmask.com/blog/how-to-evaluate-and-select-the-best-encryption-services) March 12, 2018 [![The Myth of “Staying One Step Ahead of the Hackers”](https://www.cloudmask.com/hubfs/Hacker%20one%20step.png)](https://www.cloudmask.com/blog/the-myth-of-staying-one-step-ahead-of-the-hackers) [The Myth of “Staying One Step Ahead of the Hackers”](https://www.cloudmask.com/blog/the-myth-of-staying-one-step-ahead-of-the-hackers) March 08, 2018 [![Why Defense In Depth Is Not Good Enough](https://www.cloudmask.com/hubfs/defense%20in%20depth.jpg)](https://www.cloudmask.com/blog/why-defense-in-depth-is-not-good-enough) [Why Defense In Depth Is Not Good Enough](https://www.cloudmask.com/blog/why-defense-in-depth-is-not-good-enough) March 02, 2018 [![Why the government isn't a fan of commercial encryption](https://www.cloudmask.com/hubfs/brafton_images/The-government-want-the-ability-to-conduct-surveillance--on-encrypted-communications_2135_40071057_0_14090523_500.jpg)](https://www.cloudmask.com/blog/why-the-government-isnt-a-fan-of-commercial-encryption) [Why the government isn't a fan of commercial encryption](https://www.cloudmask.com/blog/why-the-government-isnt-a-fan-of-commercial-encryption) November 16, 2017 [![The Encryption That Businesses Need, But CISOs Forget About](https://www.cloudmask.com/hubfs/Key%20-%202%20heads%20Depositphotos_24641695_original.jpg)](https://www.cloudmask.com/blog/the-encryption-that-businesses-need-but-cisos-forget-about) [The Encryption That Businesses Need, But CISOs Forget About](https://www.cloudmask.com/blog/the-encryption-that-businesses-need-but-cisos-forget-about) September 19, 2017 [![Why Your Data Security Strategy Should Include Data Masking](https://www.cloudmask.com/hs-fs/hub/468512/file-2584554648.jpg)](https://www.cloudmask.com/blog/why-your-data-security-strategy-should-include-data-masking) [Why Your Data Security Strategy Should Include Data Masking](https://www.cloudmask.com/blog/why-your-data-security-strategy-should-include-data-masking) September 19, 2017 Please enable JavaScript to view the <a href="http://disqus.com/?ref\_noscript">comments powered by Disqus.</a> ### Sign Up for our Newsletter to get the latest in everything cyber security. We care about your privacy, let us show you how. ### Recent Posts ### Posts by Topic - [Breach (29)](https://www.cloudmask.com/blog/topic/breach) - [Certifcation (3)](https://www.cloudmask.com/blog/topic/certifcation) - [cloud computing (7)](https://www.cloudmask.com/blog/topic/cloud-computing) - [Cloud threats (6)](https://www.cloudmask.com/blog/topic/cloud-threats) - [Common Criteria (2)](https://www.cloudmask.com/blog/topic/common-criteria) - [Compliance (18)](https://www.cloudmask.com/blog/topic/compliance) - [costs (1)](https://www.cloudmask.com/blog/topic/costs) - [cyber threats (22)](https://www.cloudmask.com/blog/topic/cyber-threats) - [Cybercrime (6)](https://www.cloudmask.com/blog/topic/cybercrime) - [data centric protection (1)](https://www.cloudmask.com/blog/topic/data-centric-protection) - [Data Masking (25)](https://www.cloudmask.com/blog/topic/data-masking) - [data privacy (28)](https://www.cloudmask.com/blog/topic/data-privacy) - [data residency (4)](https://www.cloudmask.com/blog/topic/data-residency) - [data security (9)](https://www.cloudmask.com/blog/topic/data-security) - [Data Sovereignty (8)](https://www.cloudmask.com/blog/topic/data-sovereignty) - [defense in depth (1)](https://www.cloudmask.com/blog/topic/defense-in-depth) - [Email Security (5)](https://www.cloudmask.com/blog/topic/email-security) - [encryption (8)](https://www.cloudmask.com/blog/topic/encryption) - [financial (1)](https://www.cloudmask.com/blog/topic/financial) - [Google (5)](https://www.cloudmask.com/blog/topic/google) - [governance (3)](https://www.cloudmask.com/blog/topic/governance) - [Government surveillance (13)](https://www.cloudmask.com/blog/topic/government-surveillance) - [hacking (1)](https://www.cloudmask.com/blog/topic/hacking) - [Healthcare (2)](https://www.cloudmask.com/blog/topic/healthcare) - [insider threats (3)](https://www.cloudmask.com/blog/topic/insider-threats) - [Legal (6)](https://www.cloudmask.com/blog/topic/legal) - [New Security Paradigm (6)](https://www.cloudmask.com/blog/topic/new-security-paradigm) - [Password (4)](https://www.cloudmask.com/blog/topic/password) - [Personal Data Protection (17)](https://www.cloudmask.com/blog/topic/personal-data-protection) - [PKI (1)](https://www.cloudmask.com/blog/topic/pki) - [Regulation (1)](https://www.cloudmask.com/blog/topic/regulation) - [RSA2017 (1)](https://www.cloudmask.com/blog/topic/rsa2017) - [Shadow it (1)](https://www.cloudmask.com/blog/topic/shadow-it) - [Tokenization (3)](https://www.cloudmask.com/blog/topic/tokenization) - [User Privacy (10)](https://www.cloudmask.com/blog/topic/user-privacy) see all - [About Us](https://www.cloudmask.com/about) - [Pricing & Plans](https://www.cloudmask.com/subscription-plans/) - [Partners](https://www.cloudmask.com/about/cloud-partners/) - [Get in touch with us](https://www.cloudmask.com/contact-us) **CloudMask Inc.** +[1 (819) 282-1501](tel:1%20(819)%20282-1501)[+1 (866) 202-4443](tel:1-866-202-4443) - What We Protect - [For Business Users](https://www.cloudmask.com/business) - [For Enterprise](https://www.cloudmask.com/enterprise) - [For Developers](https://www.cloudmask.com/saas-developers) - Who We Help - [Legal](https://www.cloudmask.com/e2ee-for-legal-sector) - [Financial](https://www.cloudmask.com/e2ee-for-financial) - [Healthcare](https://www.cloudmask.com/e2ee-for-healthcare) - [Education](https://www.cloudmask.com/e2ee-for-education) - Resources - [Help & Support](http://help.cloudmask.com) - [Blogs](https://www.cloudmask.com/blog) - [News](https://www.cloudmask.com/news) - [Videos](https://www.cloudmask.com/videos) [![Cloudmask](https://www.cloudmask.com/hs-fs/hubfs/CloudMask_Aug2016/CM-Logo-200-50.png?width=200&height=50&name=CM-Logo-200-50.png "Cloudmask")](https://www.cloudmask.com/) © 2012-2017 CloudMask All Rights Reserved