Passwords were invented to protect things; to make systems more secure. 

But today? That is no longer the case. 

Instead of a reliable defense, passwords have become one of the weakest links in cybersecurity. Managed service providers (MSPs) face this struggle more than most. They manage countless user credentials, endless reset requests, and defend against password-related breaches across their clientele. 

Cybercriminals are getting smarter. Their ability to exploit weak or reused passwords is a growing threat to the integrity of client systems. Luckily, passwordless authentication provides a more secure alternative to using traditional passwords. Let’s explore why passwords are problematic for your business, how you can benefit from passwordless authentication, and how to implement it successfully.

Why Passwords are a Problem for MSPs

Can you guess the most common password in the world? 

Your guess is probably right. According to Cybernews it is “123456”. While it’s almost impossible to use such a password today due to password policies, weak passwords still lead to data breaches for many users.

In fact, weak passwords were the reason why 30% of internet users have experienced data breaches. For MSPs, making sure this never happens to their client is often the part of the deal. However, cyberattacks are more sophisticated than ever, which makes traditional password-based systems inefficient and risky. 

Some of the key reasons why as an MSP you should start rethinking about your password strategy for your clients:

Weak password practices

Many users continue to use weak passwords. Despite password policies, clients often reuse passwords across multiple platforms. They also create new ones that don’t meet security standards. If a system or app isn’t managed, the MSP may not have any control over the matter. This leaves gaps in client security postures that open the door to brute-force attacks and credential stuffing.

Credential theft and phishing attacks

57% of organizations go through phishing attempts on a weekly or daily basis.

Passwords are often the primary targets for attackers. They focus on credential theft largely through phishing attacks. Therefore organizations that don’t implement passwordless authentication are under higher risk of these attacks. Regardless of the amount of security training you put in place, passwords will always be a risk if they are still in the equation.

Password-related support ticket overload

Managing client password resets, account lockouts, and other passwords-related tickets consumes a significant amount of an MSPs’ time. This could be used for more critical tasks and strategic IT management instead.

Compliance risks

Compliance regulations like HIPAA, PCI-DSS, GDPR, and SOX mandate stringent guidelines around password policies. Ensuring all client environments meet these requirements can be a challenge, especially when each regulation has its own set of rules. On top of that, if you have multiple clients across different industries, it becomes even more difficult.

Security gaps due to human error

To err is human. Even when password policies are in place, human error leads to security risks. End users might bypass your policies (e.g. using personal information or predictable patterns in passwords) or fall victim to phishing attacks.

Suggested reading:Best Practices for IT Password Security

What is Passwordless Authentication?

Passwordless authentication is a security method that allows users to access applications, systems, and data without the need for a traditional password. Instead of requiring password input, passwordless authentication relies on alternative, more secure methods to verify user identities. These include biometrics, hardware tokens, email or SMS-based one-time passcodes (OTPs), cryptographic keys, and Single Sign-On (SSO).

Just one weak password can put an entire organization’s network and data at risk.

Even as cybersecurity teams are turning to new advances in authentication methods (like passwordless) every day, passwords are still the way that most of us sign on to our online accounts. That also means password breaches are still one of the easiest ways for bad actors to infiltrate systems.

Whether passwords are personal or professional, users tend to follow the same (bad) habits — and utilize a lot of the same passwords. So, it’s important for organizations to set policies and hold trainings that promote the use of strong passwords and seek safeguards with the use of additional authentication methods.

These are some of the emerging and recurring password trends and statistics so far this year.

Editor’s Picks: Password Statistics

Most users don’t realize how easy it is for attackers to breach a portal through weak passwords—and they don’t consider how much damage a breach causes.

• 70% of weak passwords can be cracked in less than 1 second by hackers using simple brute force attacks.
• Weak passwords are the cause for over 80% of organizational data breaches.
• Up to 30% of data breaches at organizations are caused by individual users sharing passwords, reusing passwords, or falling for phishing scams.
• On average, data breaches cost over $4 million per incident, with larger organizations facing damages that can rocket to tens and hundreds of millions.
• Strong passwords are more effective than most people realize. A complex 12 character password takes 62 trillion times longer to crack than a 6 character password.

JumpCloud Password Manager

JumpCloud’s decentralized architecture eliminates master passwords.

Get the Details

Consumer Password Statistics

In 2024 the password story was the same for a lot of consumers. Overall, people still have the bad habit of using weak passwords and recycling credentials—setting the same passwords across multiple accounts.

But with cyberattacks on the rise, people are starting to become more password savvy and seek new solutions like password generators or password managers.

10 Most Common Weak Passwords

The most common weak passwords have become classics at this point. Strings of sequential numbers, letters, keys, and of course “password” itself top this year’s list yet again.

1. 123456
2. admin
3. 12345678
4. 123456789
5. 1234
6. 12345
7. password
8. 123
9. Aa123456
10. 1234567890

Old favorites like “Qwerty,” “Password123,” and “000000” still rank among the top 25 too.

Average Number of Passwords per Person

Password usage continues to climb steadily in tandem with the use of online accounts.

• In 2020, individuals averaged more than 100 online accounts that required passwords.
• In 2024, the number of passwords grew to almost 170 per individual.
• Most people use an additional 80-90 passwords at work.

Password Reuse Rates

Password reuse rates remain high, which makes it easier for cybercriminals to take advantage of credential stuffing to break into multiple online accounts. Credential stuffing uses automated processes to try passwords and usernames on thousands of different websites.

• Up to 60% of individuals say they reuse passwords across multiple sites.
• 13% of people use the same passwords for all accounts.

Password Hygiene and Security

Security has improved as people get more educated about online crimes and identity theft, but there’s still a long way to go when it comes to protecting accounts.

• The use of multi-factor authentication (MFA) has increased to roughly 50% of individual users.
• It’s estimated 20-30% of people still write their passwords down, making it easier for others to find them.
• About 30% of people regularly change their passwords, which offers more protection if done right. But new studies have shown that password changes often lead users to make weaker passwords which can be counterproductive.
• Users share passwords with each other in 10-20% of their accounts.
• Streaming services have the highest number of password and account shares at 22%. Passwords for online shopping accounts are shared at a rate of 17%.

Business Password Statistics

Since the remote work boom, organizations have made password and account protection a priority. While security standards and improved tools help, weak points persist with employees on an individual level.

Password Management in Organizations

Password policies and management tools tend to be more stringent in larger organizations, then fall off with small- to medium-sized businesses (SMBs).

• 83% of enterprise organizations use multi-factor authentication. 70% have implemented password management tools. However, it’s been found that 52% of users reuse passwords across multiple accounts.
• 60% of SMBs use MFA. 50% deploy password managers. Around 70% have password policies, but policy enforcement enforcement may not be as strict as larger companies.
• Government and academic institutions deploy the highest level of account protections with 95% using MFA, 80% using password management, and 100% authoring strong password policies.

Employee Password Behaviors and Hygiene

Even with password policies in place, it’s difficult for organizations to control the actions of every one of their users. Some employees are simply lax with security, while others bend the rules if they get in the way of getting the job done.

• Surveys suggest about half of all employees reuse the same passwords for work and personal accounts.
• About 25% of co-workers share passwords with each other.
• Password fatigue is a growing problem for workers, with frequent password changes and the number of passwords needed for different accounts leading to the use of weaker passwords overall.

Password Policies in Enterprises

Writing and enforcing password policies is one of the best first lines of defense against hackers. Here are some guidelines for creating an effective password policy for your organization.

• Set a minimum length of 12 characters.
• Require different character types, including upper and lower case letters, numbers, and special characters.
• Prohibit the use of common patterns and simple sequences, like 123456.
• Prohibit the use of personal information, such as birthdays.
• Change passwords every 90 days.
• Keep a history of previous passwords and prohibit password reuse.

In addition to password policies, there are strategies and tools that will increase the effectiveness of security when combined with passwords.

• Use multi-factor authentication, including time-based codes and passwords or biometric authenticators.
• Use single-sign on (SSO) to reduce vulnerabilities to a single point, reduce password fatigue, and enhance the password experience for users.
• Set up self-service reset for users, so that they can reset passwords quickly without waiting for IT.

Pricing Options for Every Organization

Packages and A La Carte Pricing

Explore JumpCloud Pricing

Data Breach Statistics

Data breaches are costly, resulting in damage to networks, lost productivity, fines and litigation, and loss of customers. Both Accenture and the Ponemon Institute estimate the cost of a data breach to average over $4 million.

Password-Related Data Breaches

Password breaches are still the most common way for cybercriminals to gain unauthorized access into networks. Compromised passwords account for more than half of all data breaches.

• Phishing is the culprit behind 70% of password theft, as methods evolve with technology.
• Brute force attacks, where bad actors randomly guess passwords, are effective a surprising 20% of the time.
• Credential stuffing is responsible for about 10% of breaches.
• Up to 30% of data breaches are enabled by internal factors, like sharing passwords, credential recycling, or users falling for phishing scams.

Impact on Personal and Business Data

While statistics vary depending on organizations and individuals, studies indicate improving password policies and management is proven to prevent attacks and data breaches.

• Password management reduces the risk of breaches by 30-50%.
• Enhanced security measures like MFA and SSO reduce the risk of cyberattacks by up to 25%.
• Customer trust increases by up to 20% for companies with a reputation for cybersecurity.

Case Studies and Examples

The average cost of a data breach is around $4 million, but the cost of the biggest breaches soars far above. Many organizations often face repercussions that go beyond finance. 2024 has produced some of the most damaging data breaches on record.

Ticketmaster

Millions of customers had their personal and financial information stolen from Ticketmaster’s database in April and May in what was believed to be a credential stuffing attack. Customers immediately started reporting incidents of identity theft. Cybersecurity was one of a number of problems that the U.S. Department of Justice found in an investigation into the company, and contributed to a lawsuit that the DOJ filed against Ticketmaster and Live Nation.

Dell

A hacker used a brute force attack to gain access to Dell’s network using a backdoor through a Dell reseller’s client portal. The attack leaked customer data and payment information across the web. Dell’s security practices were put under scrutiny by federal regulators as legal issues with customers piled up.

RockYou2024

This wasn’t a single organizational breach, but a massive password leak that’s thought to be the biggest in history. Almost 10 billion passwords compiled from a combination of past and current data breaches were dropped in a text file on an online forum. That volume of passwords from one source creates a huge opportunity for attackers using credential stuffing to carry out successful future attacks.

The Future of Password Security

By now, cybersecurity experts are aware password security has its limits when left in the hands of individuals. New technologies that generate and manage passwords or provide authentication without the need for passwords at all will eventually reduce the reliance on individuals within organizations.

Passwordless Authentication Trends

More and more organizations are adopting tools like push notifications, time-based security codes, hardware tokens, and biometrics as they seek ways to implement passwordless authentication.

If you’re seeking a solution for passwordless authentication, JumpCloud Go™ is a phishing-resistant device-level authentication method that offers the ability to authenticate without a password. JumpCloud Go uses biometric authenticators to reduce password usage and satisfy MFA requirements for SSO apps used on managed macOS, Windows, and Linux devices. JumpCloud Go is part of JumpCloud’s Platform and Platform Prime packages.

You can explore the entirety of JumpCloud’s security features with our guided sims.

Innovations in Cybersecurity

New developments are making logins more secure every day, with improvements in password creation and management, plus new authentication methods.

• Biometric authenticators are gaining popularity with users and organizations. Fingerprint and facial ID logins are the most common.
• Hardware security modules (HSMs) create cryptographic keys and store them in a secure environment. They are being used more frequently in payment processing, digital signatures, and cloud computing situations.
• AI is being used to assess password strength, identify phishing threats, and monitor behavioral biometrics and device usage to detect anomalies and suspicious activity.
• Cloud-based sync is being deployed to centralize password management, improve version control and security updates, and reduce the risk of data loss.

Predictions and Future Challenges

Exploiting weak passwords is a proven strategy for bad actors. AI gives cybercriminals new ways to launch password attacks, making phishing more believable and credential attacks more powerful.

Organizations can counter password attacks by improving user awareness and seeking authentication methods that relieve password fatigue. Password management and generation take the pressure off individual users and makes it easier for admins to ensure policies are followed. Passwordless authentication through push notifications, one-time and time-based passwords add an extra layer of security.

JumpCloud Password Manager is integrated across our product and directly into all SSO applications. Read more to see how JumpCloud helps your team to securely manage and share passwords, 2FA tokens, and other sensitive information while giving your security team full control over passwords used across your organization.

Sign up to create a free trial account to see how JumpCloud improves password management and authentication for everyone on your team. If you’re not ready to get your hands dirty (yet) try signing up for a free, no-obligation demo from a JumpCloud expert to ask pointed questions and learn how JumpCloud may fit your specific needs.

Congratulations! Your organization has been acquired. 

It’s an exciting milestone, but one that also creates a flurry of questions and uncertainty. That ambiguity can translate down into tactical areas such as what toolset will the IT organization be working with.

Of course, the general approach to most acquisitions is that the smaller organization will be assimilated into the larger one, adopting their culture, policies, solutions, and approaches. While that may be the conventional wisdom and traditional approach to mergers and acquisitions (M&A), the good news is that smart acquirers are realizing that the companies that they are buying often have more progressive approaches to technology.

There is no reason that your organization can’t be one of those that ends up leading change and transformation with the parent. With tens of thousands of organizations leveraging JumpCloud, we have seen a significant number of transactions. We have seen some of the largest organizations in the world purchase nimble, fast moving organizations and then turn around only to leverage their solutions inside of the parent. A top notch technical organization should not immediately believe that their approaches to success won’t be valued or leveraged by the parent.

Communicating Value

To determine whether the parent is open to leveraging the acquisition’s technology, methodologies, and more, you can often analyze why the deal occurred in the first place. While customers and revenue are also often drivers, smart acquirers realize that they have more to gain from an acquisition than just financial benefits. 

Often, larger organizations are interested in another organization’s technology, process, people, and systems. To that end, we see acquirers leveraging their acquisitions as pilots and lighthouse implementations for critical, new, and innovative approaches to their business.

Of course, this doesn’t just happen. 

A parent organization needs to be open to learning and trying new and innovative approaches. The good news is that conversation and thoughtful communication can help make this happen. 

The primary point that we see being successful in keeping innovative infrastructure is by focusing on the benefits. 

Larger organizations are often in need of cultural change or transformation in some way. By connecting what an acquisition is doing as a potential trial implementation to that transformation, a parent organization can learn at low risk and then, if successful, more easily roll out the new approach within the parent organization. 

Employees at the parent can even see the innovation in action, often reducing the anxiety of change. Smart acquirers are hoping to squeeze every last piece of value out of the companies that they buy and learning from their systems, processes, and people is a good way to do that.

Let Us Help

When it comes to IT management tools such as JumpCloud, the opportunity to test and understand cloud innovations is powerful. With JumpCloud, new organizations can enable their employees to take advantage of new IT resources while tightly controlling their environments. 

Also, with a multi-tenant portal interface, parent organizations can easily implement the cloud directory service while also segmenting access controls. For those parent organizations that leverage Active Directory, JumpCloud can integrate with AD to provide the best of both worlds.

JumpCloud’s account management and technical support teams would be happy to meet with you or your parent organization to discuss the best ways to take advantage of this modern cloud identity management platform.

Contact us to start strategizing how your organization can best partner with its acquirer.

Editor’s note: this article is meant to be a helpful guide for Linux administrators and enthusiasts, and does not necessarily imply direct coverage within the JumpCloud Directory Platform. While JumpCloud has a wide array of features that support multiple Linux distributions, we recommend looking at our compatibility matrix to ensure adequate coverage for the distributions you support. 

Encryption is considered to be a fundamental aspect of securing data. For Linux users, especially those using popular distributions such as Ubuntu, Debian, RedHat, Fedora, or others, selecting the appropriate encryption tools can significantly impact the security and performance of their system. We will comprehensively analyze existing and mostly used encryption tools available for these distributions so that we can explore features, strengths, and weaknesses. 

Before providing different encryption tools, we need to understand the basic concepts of encryption. Encryption is the process of converting data into code to prevent unauthorized access. It is achieved by using algorithms that transform the original information which is in plain text format into an unreadable format or ciphertext. There are multiple approaches to encryption and also the security itself depends on the strength of the algorithm and the secrecy of the key that is used to encrypt and decrypt the data.

Key Types of Encryption

• Symmetric Encryption: Uses the same key for both encryption and decryption. This type of encryption includes AES (Advanced Encryption Standard) and DES (Data Encryption Standard)
• Asymmetric Encryption: This type utilizes a pair of keys, where a public key is used for encryption and a private key for decryption. Examples are RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography).

Different Types of Encryption Tools for Linux

Several encryption tools can be used in Linux, and each of these has its unique features and use cases. They also come with pros and cons. We will focus on the following tools:

• GnuPG (GPG)
• dm-crypt/LUKS
• EncFS
• eCryptfs
• VeraCrypt

GNUPG (GPG) 

GnuPG, or GPG is an open-source implementation of the OpenGPG standard. It is mainly used when encrypting files and communications, offering both symmetric and asymmetric encryption. It works across multiple Linux distributions, there is a proper key management where we can generate, sign, or revoke a key. It supports both file encryption and email encryption. The only drawback is that can be challenging for beginners due to the command line interface and also complex key management.

Let’s try to generate a GPG key pair, encrypt a file, and then decrypt it. In this example, we will use the latest Ubuntu 24.04 version.

GPG is already installed on Ubuntu by default, so the next step is to generate a GPG key pair with the following command:

Choose the default setting under number 1, which is RSA and RSA.

Next, select the key size, where the 2048-bit setting is fine but the 4096-bit setting is more secure. 

The following prompt will ask us about the key expiration, so we can choose for how long you want the key to be valid. For this example, we can choose 0 for no expiration. To increase the security of your files and information, consider placing proper expiration.

The next prompt is where we can add the real name, email address, and potential comment. These fields are not mandatory and at the bottom of the prompt, you can press O and Enter.

Now we need to enter the passphrase so we can protect our key. Make sure to place complex passwords and combinations of letters (both uppercase and lowercase), numbers, and special characters.

After the process, you will get a similar output:

Now we can first create a sample file and encrypt it with our newly generated GPG key:

Make sure to change the command according to your user ID.

If we list the directory we will see that a new file has been created with the extension .gpg

Now, we can decrypt our file by running the following command. Also, we will be prompted for the passphrase that we set up earlier.

After the decryption process, we can see that the contents of our file are the same as the one we encrypted.

dm-crypt/LUKS

Dm-crypt and LUKS are often mentioned together because they are complementary components used for disk encryption in Linux. Dm-crypt is a kernel-level disk encryption sub-system which a part of the Linux device mapper, and it can encrypt entire disks or partitions. Since it’s a part of the Linux kernel, this means that it offers highly efficient encryption while supporting various encryption algorithms and key sizes. 

LUKS (Linux Unified Key Setup) is a standard for disk encryption and it is primarily designed to simplify the usage of dm-crypt. It provides a standardized on-disk format that ensures proper compatibility while simplifying the process of setting up and managing encrypted partitions. It also supports multiple passphrases, which allows easier key management and recovery.

In this process, when you configure the disk encryption you use tools like “cryptsetup” tool which will initialize LUKS on the partition and manage it. We have articles that cover the entire process of encryption with LUKS. 

EncFS

EncFS is an encryption tool where it runs without any kernel-level modifications. This type of encryption will encrypt individual files rather than entire partitions, and it is simple to set up and use for beginners. The drawback is that it is slightly slower than kernel-based encryption methods due to user-space operation. There is also a concern about the strength of its encryption compared to other tools.

If you try to install it on the latest version of Ubuntu, you will receive the following information:

eCryptfs

eCryptfs is a stacked cryptographic file system that allows you to encrypt certain directories. This tool will automatically encrypt and decrypt files as they are accessed. When it comes to integration, they are built into the Linux kernel, which ensures compatibility and performance. It is easy to use and generally, it has good performance due to kernel-level integration. One of the drawbacks is less flexibility regarding encryption options and configurations. There is also limited community support compared to other tools.

We can start by installing the utilities needed for this tool:

Next, we can create two directories, one for the encrypted data and one for the mount point.

Now, we can mount the “encrypted_data” directory to “decrypted_data” using eCryptfs:

We will be prompted to enter our preferred option, in our case we will use the passphrase. So, press 1 and press Enter.

We can also proceed with the default value of aes, select the keysize to 32, and type n for the Plaintext Passthrough option, since in that case files written to the eCryptfs mount point are not automatically encrypted. This can be useful for debugging and testing purposes, but make sure to disable this option in production environments.

In this process, we will also enable filename encryption:

We can now use the “decrypted_data” directory as we would use any directory in our system. The files in this directory will be encrypted and stored in the “encrypted_data” directory.

Next, we can create a file in the decrypted directory.

We can verify that the file is encrypted if we check the contents of our “encrypted_data” directory.

VeraCrypt 

VeraCrypt is a popular open-source disk encryption tool that is derived from TrueCrypt. It can offer both full-disk encryption and virtual encrypted disks. It is available for different operating systems such as Linux, MacOS, and Windows. VeraCrypt also supports the creation of hidden volumes for increased security. It comes both with GUI as well as command-line options. Some of the drawbacks are slightly higher overhead when compared to native Linux tools and some advanced features can be complex to configure.

Comparing Encryption Tools Across Linux Distributions

Different Linux distributions (and their communities) may favor one tool over another. The same goes for compatibility, default configurations, and package management. Here is a breakdown of encryption tools for popular distributions.

Ubuntu and other Debian-based distributions

• GnuPG: Essential part of the system, used for package signing and more.
• dm-crypt/LUKS: Supported with extensive documentation where tools like “cryptsetup” are readily available.
• EncFS: It is available in the repositories but due to security issues, it is not the preferred tool to use.
• eCryptFS: Commonly used for home directory encryption; it’s not pre-configured and may require a manual setup for Debian. 
• VeraCrypt: This tool is available for installation through third-party repositories, and the basic setup is relatively easy to use.

Redhat, Fedora, and other RHEL derivatives

• GnuPG: Mainly used for securing communications and package signing.
• dm-crypt/LUKS: It’s a preferred method of disk encryption and it also has enterprise-level support for RedHat. Cryptsetup is readily available, similar to Debian-based distributions.
• EncFS: It is available for installation, however, it is not preferred or recommended for enterprise environments due to security issues.
• eCryptFS: Supported, with good documentation and community support. It is less used compared to dm-crypt/LUKS.
• Veracrypt: Available through third-party repositories but it’s less commonly used in enterprise environments. It is directly supported by Fedora.

Choosing the Right Encryption Tool

Selecting the right encryption tool for your Linux operating system ultimately depends on your needs and the distribution you are using. 

We can recommend dm-crypt/LUKS for full-disk encryption across all distributions. It is a great choice that offers strong security and it doesn’t affect the performance of your system. 

When you need to encrypt specific files or directories, tools like GnuPG and eCryptFS provide enough protection as well as flexibility and ease of use. EncFS can be used for testing, but we are not recommending it for production environments. VeraCrypt is also a good choice for users who work across different operating systems and GUI can help with the configuration.

Choosing the exact encryption also depends on the requirements for your use case, security requirements, technical proficiency, and specific demands of your Linux distribution. By understanding the features and capabilities of each tool you can make an informed decision.

JumpCloud offers a wide range of management capabilities to support Linux systems across many different distros and versions. If you haven’t seen them yet, head to our Help Center where you can see what versions of Linux we support as well as guides on important topics like configuring settings for Linux policies, setting up patching schedules, and (of course) configuring data encryption on Linux devices.