A recent survey by Rainbow Technologies indicates that the use of insecure passwords can be costly -- and potentially risky -- for corporate data.
According to the survey, based on responses from 3,000 IT administrators, executive managers and security professionals, the problem stems from the sheer number of inherently insecure user names and passwords in use -- along with the fact that many users write their passwords down, according to the security vendor.
The need to frequently change log-ins and passwords can also cost businesses money when users find they are unable to log in to business-critical data and applications, said Shawn Abbott, president of Rainbow eSecurity.
A summary of the findings shows
- That 55 percent of end users reported that they write passwords down at least once.
- That 9 percent of all users write every password down.
- That 40 percent of users share passwords, contributing to insecurity in virtual private networks (VPN) and Secure Sockets Layer VPN environments.
- That the average user manages more than five passwords and that over 24 percent of users have at least eight user names and passwords on their system at any one time.
- That 80 percent of respondents indicated that their organizations have implemented password-strengthening techniques (using "nonwords" for passwords, or combinations of numbers and letters) and that this actually increases the likelihood that the password is written down or forgotten.
- That 51 percent of all users require IT help to access applications because they forgot the password.
Pete Lindstrom, an analyst at Spire Security in Malvern, Pa., agreed with Rainbow's findings. "This has been a problem for as long as I remember -- we tend to neglect the human element of security and it comes back to bite us," he said.
Lindstrom said that in 1980s and 1990s, everyone recommended long passwords that were hard to guess. But, he said, that also makes them hard to remember. "In general, people are freewheeling with their passwords because they don't really internalize the risk to the enterprise. People will often just tell you their passwords if/when asked."
Lindstrom said the real question has always been how to implement strong authentication cost-effectively.
"Since native user IDs and passwords are free (every major package has the basic capabilities built in), it makes it more difficult to cost-justify," he said. "Nowadays, we can start to comprehend the level of risk this provides in the enterprise."
Amit Jasuja, vice president of product management at security vendor Netegrity in Waltham, Mass., said the survey is correct in finding that managing passwords is a challenge for companies.
"It is often very expensive as well," he said. "But one has to understand the human and cultural factors in how people work with computers, as well as cost considerations, before making a statement that passwords should be replaced by security tokens or PKI (public-key infrastructure) certificates."
Jasuja said tokens make sense where the information is highly sensitive and the number of users is few and highly security-conscious. Passwords make sense where the information is sensitive and the user community is large and diverse in their understanding of technology.
What's important, he said, is using a combination of the right kind of technology and best practices -- including a reduction in the number of accounts, a smaller number of passwords, and a self-service password reset technology to help users reset forgotten passwords.