A recent survey by Rainbow Technologies Inc. indicates that the use of insecure passwords can be costly -- and potentially risky -- for corporate data.
According to the survey, based on responses from 3,000 IT administrators, executive managers and security professionals, the problem stems from the sheer number of inherently insecure user names and passwords in use -- along with the fact that many users write down their passwords, according to the Irvine, Calif.-based security vendor.
The need to frequently change log-ins and passwords can also cost businesses money when users find they are unable to log in to business-critical data and applications, said Shawn Abbott, president of Rainbow eSecurity.
The following is a summary of the findings:
- 55% of end users reported that they write passwords down at least once.
- 9% of all users write every password down.
- 40% of users share passwords, contributing to security gaps in virtual private networks (VPN) and Secure Sockets Layer VPN environments.
- The average user manages more than five passwords, and over 24% of users have at least eight user names and passwords on their system at any one time.
- 80% of respondents indicated that their organizations have implemented password-strengthening techniques (using "nonwords" for passwords, or combinations of numbers and letters) and that this actually increases the likelihood that the password is written down or forgotten.
- 51% of all users require IT help to access applications because they forgot the password.
Pete Lindstrom, an analyst at Spire Security LLC in Malvern, Pa., agreed with Rainbow's findings. "This has been a problem for as long as I remember -- we tend to neglect the human element of security, and it comes back to bite us," he said.
Lindstrom said that in the 1980s and 1990s, everyone recommended long passwords that were hard to guess. But, he said, that also makes them hard to remember. "In general, people are freewheeling with their passwords because they don't really internalize the risk to the enterprise. People will often just tell you their passwords when asked."
Lindstrom said the real question has always been how to implement strong authentication cost-effectively.
"Since native user IDs and passwords are free (every major package has the basic capabilities built in), it makes it more difficult to cost-justify," he said. "Nowadays, we can start to comprehend the level of risk this provides in the enterprise."
Amit Jasuja, vice president of product management at security vendor Netegrity Inc. in Waltham, Mass., said the survey is correct in finding that managing passwords is a challenge for companies.
"It is often very expensive as well," he said. "But one has to understand the human and cultural factors in how people work with computers, as well as cost considerations, before making a statement that passwords should be replaced by security tokens or PKI [public-key infrastructure] certificates."
Jasuja said tokens make sense when the information is highly sensitive and the number of users is few and the users are highly security-conscious. Passwords make sense when the information is sensitive and the user community is large and diverse in its understanding of technology.
What's important, he said, is using a combination of the right kind of technology and best practices -- including a reduction in the number of accounts, a smaller number of passwords and a self-service password-reset technology to help users reset forgotten passwords.
Rainbow Technologies is promoting its own authentic hardware device, the iKey. The iKey -- a standard feature of the NetSwift iGate appliance -- effectively eliminates the need for user names and passwords for secure remote access, according to the company. When a user's credentials are passed along from the iKey, the application doesn't look for a user name and password; it looks for a random string developed by the iKey and unlocked with a PIN.
The two-factor authentication occurs when the iKey is inserted into a computer's Universal Serial Bus port and a simple PIN is typed in. Doing so grants the user secure access to core business applications.