Topic starter
12/07/2026 12:18 pm
TL;DR: Weak passwords, credential reuse, phishing, and insecure web traffic remain the core identity and communication risks highlighted in GlobalSign’s Segurinfo 2016 presentation, which recommends stronger authentication, S/MIME email protection, and SSL/TLS encryption for corporate data flows. The identity lesson is unchanged: if trust is built on shared secrets, attackers will target the human workflow first.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “La Importancia de la Seguridad de la Información”.
Key questions
Q: How should IAM teams reduce password-related productivity loss?
A: They should start by measuring where password failures interrupt work most often, then redesign the highest-friction journeys first.
Q: Why do phishing campaigns still work even when organisations have security tools in place?
A: They often succeed before tooling has a chance to intervene.
Q: How do S/MIME and SSL/TLS address different identity risks?
A: S/MIME protects the authenticity and confidentiality of email messages, while SSL/TLS protects data in transit between a user and a website or application.
Practitioner guidance
- Tighten password reuse controls Block reused credentials where possible, and prioritise high-value corporate identities that share patterns with personal accounts.
- Deploy sender verification for sensitive email Use S/MIME or an equivalent email signing model for communications that carry business-sensitive instructions or data.
- Enforce encrypted web sessions Require SSL/TLS for any portal or application handling credentials, customer data, or internal workflows.
Bottom line: Credential theft becomes more damaging when users reuse passwords across personal and corporate accounts, because one exposed secret can unlock multiple identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:32 pm
Credential reuse is an identity governance failure, not a user habit problem. The article’s strongest point is that copied or shared passwords let attackers move from a weak personal account into a corporate one. That is a lifecycle and governance issue because the enterprise cannot prove uniqueness or exclusivity of the credential. Practitioners should read this as a signal that authentication policy is only as strong as the reuse boundary it enforces.
A question worth separating out:
Q: When should organisations treat identity assurance as more important than user awareness?
A: When a single stolen password or convincing email can lead to corporate access, identity assurance has to come first. Awareness helps, but it cannot reliably prevent credential reuse or targeted impersonation. Controls that verify the identity of the user and the sender are more dependable than human detection alone.
👉 Read our full editorial: Credential theft and phishing expose identity gaps in digital security