Cloud professionals ‘overly attached to password-based security’