A survey by Rainbow Technologies has indicated that the
use of insecure passwords can be costly - and potentially risky -
for corporate data.
Based on responses from 3,000 IT administrators, executive
managers and security professionals, the survey found that the
problem stemmed from the sheer number of inherently insecure user
names and passwords in use - along with the fact that many users
write their passwords down.
The need to change logins and passwords frequently can also cost
businesses money when users find they are unable to log in to
business-critical data and applications, said Shawn Abbott,
president of Rainbow eSecurity.
"This has been a problem for as long as I remember - we tend to
neglect the human element of security and it comes back to bite
us," said Pete Lindstrom, an analyst at Spire Security.
Lindstrom said that in the 1980s and 1990s, everyone recommended
long passwords that were hard to guess. But, he said, that also
makes them hard to remember.
"In general, people are freewheeling with their passwords
because they don't really internalise the risk to the enterprise.
People will often just tell you their passwords if/when
asked."
Lindstrom said the real question has always been how to
implement strong authentication cost effectively.
"Since native user IDs and passwords are free [every major
package has the basic capabilities built in] it makes it more
difficult to cost-justify," he said. "Nowadays, we can start to
comprehend the level of risk this provides in the enterprise."
Amit Jasuja, vice-president of product management at security
supplier Netegrity, said the survey is correct in finding that
managing passwords is a challenge for companies.
"It is often very expensive as well," he said. "But one has to
understand the human and cultural factors in how people work with
computers, as well as cost considerations, before making a
statement that passwords should be replaced by security tokens or
PKI certificates."
Jasuja said tokens make sense where the information is highly
sensitive and the number of users is few and highly
security-conscious. Passwords make sense where the information is
sensitive and the user community is large and diverse in their
understanding of technology.
What is important, he said, is using a combination of the right
kind of technology and best practices - including a reduction in
the number of accounts, a smaller number of passwords, and a
self-service password reset technology to help users reset
forgotten passwords.
Other findings from the survey:
- 55% of end users reported that they write passwords down at
least once.
- 9% of all users write every password down.
- 40% of users share passwords, contributing to insecurity in
virtual private networks (VPN) and Secure Sockets Layer VPN
environments.
- The average user manages more than five passwords and that more
than 24% of users have at least eight user names and passwords on
their system at any one time.
- 80% of respondents indicated that their organisations have
implemented password-strengthening techniques (using "non-words"
for passwords, or combinations of numbers and letters) and that
this actually increases the likelihood that the password is written
down or forgotten.
- 51% of all users require IT help to access applications because
they forgot the password.
Linda Rosencrance writes for Computerworld