Businesses today are in a cyber security crisis because passwords have become obsolete. The recent HBO data breach, in which hackers demanded a ransom for internal emails along with a wealth of valuable network documents, is just the most recent event. There are red flags for businesses of all sizes – current protection methods just aren't cutting it. Most systems have the concept of an administrator who can access all information in the system, which means that one person's breach can bring the entire business down.

In fact, since August, nearly three quarters (73 percent) of all Americans have fallen victim to some type of cybercrime and 47 percent have had their personal information exposed by hackers. The cybersecurity “walls” that organizations have built around sensitive information are failing to stop breaches: 73 percent of hackers surveyed at the recent “Black Hat” convention believe traditional security perimeters of firewalls and antivirus are irrelevant or obsolete.

In the HBO data breach was preceded by cyber security attacks impacting millions of customers of Verizon, Yahoo and Dow Jones, the HBO case. Hackers are demanding a ransom for materials that include the draft scripts for upcoming episodes of the popular series Game of Thrones.

“Businesses are in a cyber security crisis, which directly impacts their viability,” said Randy Battat, CEO, PreVeil, who sat down with Inside Counsel in an exclusive interview. “IT managers and the C-suite may not realize that the likelihood of their server being compromised at some point is akin to death and taxes! It's increasingly obvious that current encryption methods aren't cutting it. For airtight protection, businesses should turn to end-to-end encryption, the 'gold standard' method, which protects user data even when the server is breached.”

PreVeil is turning these vulnerabilities on their head. It's in the beginning stages of helping enterprises protect their business communications with end-to-end encryption, the 'gold standard' method which protects user data even when the server is breached.

Today, the two most applied email encryption processes are encryption in transit and encryption at rest, both of which leave enterprise servers vulnerable, whether in the data center or the cloud, according to Battat. End-to-end encryption, in contrast, covers data on its journey from start to finish; messages and attachments are encrypted directly on the sender's device and are decrypted on the recipient's device. This means that only the sender and recipient can read them, but the server cannot, and anyone hacking the server sees just gibberish.

Then there is are passwords. He explained, “The credential-guessers who successfully breached HBO's email archive were relying on users' bad habits. In fact, most of the passwords used by individuals to access online accounts are the same or very similar for 39 percent of Americans. So, the hackers could rely on already-stolen login information to attempt to breach additional accounts.”

What's the lesson?

“Passwords are an inherently flawed way to protect important data stored in the cloud,” he said. “It's much more effective to rely on strong cryptographic keys stored locally on user devices, not easily guessed passwords, to facilitate user access to encrypted information in the cloud.”

It is not clear how the attackers got the data they released, but it may have had something to do with their administrative access to HBO's systems, per Battat. Hackers released screenshots showing some of HBO's administrative tools in use, which would suggest the fact that the hackers hijacked a super-user account with broad privileges. The size of the hack – which the attackers claim is 1.5 terabytes – and the access to unreleased TV shows also indicates a probable compromise of an administrator account in the HBO network.

According to Battat, first, a big red flag for businesses is password re-use as more than 80 percent of people in one study admitted using the same password for more than one service. Secondly, not encrypting sensitive data: Over nine percent of the seven billion records breached since 2014 were not encrypted. And finally, losing track of certificates and decryption keys as 54 percent of businesses don't know the location, ownership or use of their encryption keys and certificates.

“Passwords are an annoyance for users, who hate remembering, updating, and entering passwords. Bogus theories about password strength have created a perfect storm, whereby people often use passwords that are hard for them to remember, but easy for computers to guess,” he explained. “They're vulnerable to attack because hackers correctly assume people will re-use them between accounts.”

So, what is going to replace passwords?

One very promising replacement for passwords will be cryptographic keys stored in user devices, such as those used in PreVeil, according to Battat. Using them eliminates the need for users to remember and enter passwords. In addition, they provide strong protection because they're not easily guessable, they cannot be stolen from one service and used for another, and because they're not stored on servers which can be vulnerable to attack.

“End-to-end encrypting data is a critical step companies need to take,” he said. '45 percent of information technology personnel knowingly circumvent their own security policies, so it is no wonder that many normal employees do the same and do not practice good cybersecurity habits.”