Insecure passwords can be costly for companies

A recent survey by Rainbow Technologies indicated that the use of insecure passwords can be costly - and potentially risky - for...

A survey by Rainbow Technologies has indicated that the use of insecure passwords can be costly - and potentially risky - for corporate data. 

Based on responses from 3,000 IT administrators, executive managers and security professionals, the survey found that the problem stemmed from the sheer number of inherently insecure user names and passwords in use - along with the fact that many users write their passwords down. 

The need to change logins and passwords frequently can also cost businesses money when users find they are unable to log in to business-critical data and applications, said Shawn Abbott, president of Rainbow eSecurity. 

"This has been a problem for as long as I remember - we tend to neglect the human element of security and it comes back to bite us," said Pete Lindstrom, an analyst at Spire Security. 

Lindstrom said that in the 1980s and 1990s, everyone recommended long passwords that were hard to guess. But, he said, that also makes them hard to remember.

"In general, people are freewheeling with their passwords because they don't really internalise the risk to the enterprise. People will often just tell you their passwords if/when asked." 

Lindstrom said the real question has always been how to implement strong authentication cost effectively. 

"Since native user IDs and passwords are free [every major package has the basic capabilities built in] it makes it more difficult to cost-justify," he said. "Nowadays, we can start to comprehend the level of risk this provides in the enterprise." 

Amit Jasuja, vice-president of product management at security supplier Netegrity, said the survey is correct in finding that managing passwords is a challenge for companies. 

"It is often very expensive as well," he said. "But one has to understand the human and cultural factors in how people work with computers, as well as cost considerations, before making a statement that passwords should be replaced by security tokens or PKI certificates." 

Jasuja said tokens make sense where the information is highly sensitive and the number of users is few and highly security-conscious. Passwords make sense where the information is sensitive and the user community is large and diverse in their understanding of technology. 

What is important, he said, is using a combination of the right kind of technology and best practices - including a reduction in the number of accounts, a smaller number of passwords, and a self-service password reset technology to help users reset forgotten passwords. 

Other findings from the survey:

  • 55% of end users reported that they write passwords down at least once. 
  • 9% of all users write every password down. 
  • 40% of users share passwords, contributing to insecurity in virtual private networks (VPN) and Secure Sockets Layer VPN environments. 
  • The average user manages more than five passwords and that more than 24% of users have at least eight user names and passwords on their system at any one time. 
  • 80% of respondents indicated that their organisations have implemented password-strengthening techniques (using "non-words" for passwords, or combinations of numbers and letters) and that this actually increases the likelihood that the password is written down or forgotten. 
  • 51% of all users require IT help to access applications because they forgot the password.

Linda Rosencrance writes for Computerworld

Read more on IT risk management