We need to talk about passwords
- Around 75,000 Fortinet firewalls had their admin passwords cracked in a major security incident.
- The passwords were stored using SHA-256, a fast-hashing algorithm vulnerable to brute-force attacks.
- Fortinet had fixed the underlying weakness over a year before the incident, but many users did not trigger the upgrade.
The FortiBleed incident underscores the urgent need for organizations to rethink their password management strategies and prioritize user-friendly security measures. As users face increasing cognitive demands, businesses must implement systems that reduce the burden of password management while enhancing security. Transitioning to passwordless authentication could be a crucial step in mitigating risks associated with traditional password usage.
