Survey: Insecure passwords can be costly for companies

Users not only write down their passwords; they sometimes share them, too

By Linda Rosencrance

August 8, 2003 12:00 PM ET

Computerworld - A recent survey by Rainbow Technologies Inc. indicates that the use of insecure passwords can be costly -- and potentially risky -- for corporate data.
According to the survey, based on responses from 3,000 IT administrators, executive managers and security professionals, the problem stems from the sheer number of inherently insecure user names and passwords in use -- along with the fact that many users write down their passwords, according to the Irvine, Calif.-based security vendor.
The need to frequently change log-ins and passwords can also cost businesses money when users find they are unable to log in to business-critical data and applications, said Shawn Abbott, president of Rainbow eSecurity.
The following is a summary of the findings:

55% of end users reported that they write passwords down at least once.

9% of all users write every password down.

40% of users share passwords, contributing to security gaps in virtual private networks (VPN) and Secure Sockets Layer VPN environments.

The average user manages more than five passwords, and over 24% of users have at least eight user names and passwords on their system at any one time.

80% of respondents indicated that their organizations have implemented password-strengthening techniques (using "nonwords" for passwords, or combinations of numbers and letters) and that this actually increases the likelihood that the password is written down or forgotten.

51% of all users require IT help to access applications because they forgot the password.

Pete Lindstrom, an analyst at Spire Security LLC in Malvern, Pa., agreed with Rainbow's findings. "This has been a problem for as long as I remember -- we tend to neglect the human element of security, and it comes back to bite us," he said.
Lindstrom said that in the 1980s and 1990s, everyone recommended long passwords that were hard to guess. But, he said, that also makes them hard to remember. "In general, people are freewheeling with their passwords because they don't really internalize the risk to the enterprise. People will often just tell you their passwords when asked."
Lindstrom said the real question has always been how to implement strong authentication cost-effectively.
"Since native user IDs and passwords are free (every major package has the basic capabilities built in), it makes it more difficult to cost-justify," he said. "Nowadays, we can start to comprehend the level of risk this provides in the enterprise."
Amit Jasuja, vice president of product management at security vendor Netegrity Inc. in Waltham, Mass., said the survey is correct in finding that managing passwords is a challenge for companies.
"It is often

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

POLL RESULTS

Leading IT Pros Weigh In on Top IT Issues

Accelerate your knowledge of the IT world you inhabit by viewing the results of a series of polls taken by your IT peers. These polls of 100+ IT professionals each are available for full viewing. They cover key topics such as virtualization, processor performance, green IT, cloud computing and many others. Be a part of the buzz.

WHITE PAPER

For Best Results, Think Beyond the Box

Technology is complex. Keeping it running productively shouldn't be. To that end, you want to minimize the number of solutions needed in-house to simplify operations, maintenance, and support. Kodak offers a best-practices model. One company provides support for both scanner and software, for fast problem resolution without vendor finger-pointing. Download now!

WHITE PAPER

Accelerating the Path to Demand Intelligence with a Demand Signal Repository

Utilizing demand intelligence improves the precision of pricing, product assortments, channel/store placement, and promotion, which are all essential for sustainable revenue management performance. Learn more, download this free whitepaper today.

White Papers & Webcasts

Mitigating Litigation Risk with Email Management Tools
Does your company have an email retention policy that protects it when litigation occurs? IDC discusses effective email retention policies and the role...

Managing And Protecting Your Ever Increasing Mobile Assets
Learn best practices for desktop and application virtualization, computer security, and computer life-cycle management....

Protecting Content During Business Disruption: Are You Covered?
Learn how ECM is helping Tulane University and the 13th Judicial Circuit Court implement disaster readiness programs....

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

Beyond PCI Checklists: Securing Cardholder Data with Tripwire's Enhanced File Integrity Monitoring
How do organizations pass their PCI DSS audits yet still suffer security breaches? Paying attention to PCI DSS checklists only partially secures the...

Best Practices for Managing Business Risks from the Use of IT
(Source: Symantec) Based on exhaustive benchmarks conducted by the IT Policy Compliance, this session highlights the relationship between business risks and use of...

Authentication as a Service by Forrester Research
Authentication-as-a-Service: understand the benefits of two factor authentication and the best ways to implement it....

Sun OpenSSO Enterprise Webinar
(Source: Sun) This webinar replay discusses Sun OpenSSO Enterprise innovation--the single, open-source solution that helps your business solve the challenges around internal access...

Sustaining SOX Compliance: Best Practices to Mitigate Risk, Automate Compliance, and Reduce Costs
Since the adoption of SOX, much has been learned about IT compliance. Discover how to make SOX efforts more effective in "Sustaining Sox...

Agile Enterprise Content Management (ECM) for Rapid ROI
(Source: IBM) Content rich business processes are a core feature of daily operations at just about any organization today. Very often these essential...

All White Papers | All Webcasts