By Will Sturgeon, 9 March 2005 10:10
NEWS Despite a welter of warnings in recent years it appears employees are still failing to engage their brains when it comes to the simplest of tasks managing their passwords effectively.
Recent findings show a staggering 50 per cent of employees still write down their passwords while one-third of employees share their passwords.
Tony Caputo, CEO of SafeNet, who commissioned the research, said such failings mean "passwords alone do not provide sufficient security".
Part of the problem would seem to be a lack of initiative for overcoming the issue of 'password overload' with 80 per cent of respondents needing to use three or more passwords. Furthermore 67 per cent of respondents use passwords across five or more applications while 31 per cent use them to access nine or more applications.
The findings also revealed more companies are now thinking about this problem but are possibly only making more trouble for themselves by doing so.
Sixty-eight per cent of companies surveyed have been requiring employees to use longer or more complicated passwords for more than 12 months now while there has also been an increase in the regularity with which staff must change their passwords.
Almost a quarter (23 per cent) of companies require password changes at least three times a year while 15 per cent of companies insist upon changes at least five times per year. Thirty per cent of organisations require staff to change their passwords at least seven times per year.
But such policy, while suggesting awareness of the risks, can bring its own problems.
Peter Dorrington, director of fraud solutions at SAS, told silicon.com passwords are fundamentally flawed due to their tendency to meet human error in a head-on collision.
"I've heard of companies trying pretty much everything. One firm insisted staff use long complicated passwords which couldn't easily be guessed - combining numbers with upper and lower case letters. The next day they walked around the office and almost everybody's passwords were written on Post-It notes on their monitors because they couldn't remember them."
Of course making it easy to remember tends to make it easier to guess.
SafeNet's Caputo added that while employees writing down their passwords can undermine security and cost a company dear, those employees who favour a 'call the helpdesk' approach to logging-in, having forgotten their password, are similarly putting an unnecessary drain on company resources.
Dorrington told silicon.com his favoured method of authentication is biometrics such as fingerprint recognition.
"You always have your biometrics with you and they are far more reliable than passwords which can be found out or socially engineered out of you," said Dorrington.
SafeNet is one of many companies offering tokens as well as smartcards for multi-layered authentication.
RSA also offers a number of authentication solutions. A spokeswoman for the company said: "Uptake of two-factor authentication and single sign-on for remote access is definitely increasingly partly because identity theft is still such a huge issue."
According to RSA, banks in particular are currently tightening up on authentication, with other traditionally less security-minded sectors likely to follow suit further down the line.
"We're also seeing more demand for password management and authentication inside the firewall from companies wanting to enhance security, reduce helpdesk costs, increase end user satisfaction and prove compliance," added the spokeswoman.
This latest survey follows similarly worrying findings in separate research last year which revealed 70 per cent of employees would offer up their password in return for a chocolate bar.
Comments
There are 7 comments. Join the discussion
1. Cruz
last place i worked we set passwords to be changed every 30 days! You just get people using the same password but incrementing a number at the end i.e. jenny10.
I think bio-metrics are the way forward mainly because people do not forget there fingers to work!
My current company uses bio-metrics for staff to clock in and out instead of using the old clock cards.
2. anonymous
I am trying to push pass phrases where I work. "I have 2 puppies @ home", for example, is a lot easier for a user to remember. Some folks don't like typing that much but it gets easier after the 4th or 5th time you log in.
3. David King
Why not use the first letter/number/symbol for the phrase so that users are more likely to adopt the criteria.
Using your example this would be "ih2p@h".
Users could use any phrase which is meaningful to them and would be difficult to guess but easy to remember, eg. I was diagnosed with diabetes in 1998....."iwdwdi98".
4. Ajaz Poswall @ Diagonal Security
Best tip I can offer is using registeration number plates of previous cars...
5. Todd Knarr
There's one problem with biometrics. Well, actually two. First is the issue of writing them down. Yes, writing down biometrics. Take your fingerprints. Every time you touch something, you leave a copy of your fingerprints on it. Those can easily be lifted, police do it all the time during investigations. And the most common fingerprint readers have been fooled 75+% of the time using materials available at the average supermarket. How is this situation any different from writing my password on a PostIt note and sticking it, not just on my monitor, but on every wall of every building in town? Second, how do you change biometrics if compromised? Suppose someone lifts my fingerprint from a glass at the restaurant I ate dinner at, makes a copy they can glue over their own fingerprint and starts impersonating me. How do I change my fingerprint now that it's no longer proof that I'm me?
6. Chris Johnson
Postcodes, car registration numbers, and telephone numbers all provide rich sources for passwords, because you can remember, or even write down, clues to them which are meaningful only to you. I have a note of a password which reads "London CWS + Crescent car". I proffer this freely, since I think it unlikely that anyone will guess it, particularly since the references are around 50 years old!
7. CPK Smithies
Clicking on familiar photos
Someone (I'd love to find out who) once proposed a system whereby users submitted 5 small photos of people or things that were familiar to them, but would not be familiar to other users of the system.
To log in, the user would first identify themselves. The login program would respond with a mosaic of small images, containing 3 of the images selected by the user, positioned randomly within the mosaic. To gain access, the user would simply click on the 3 familiar images.
I'd love to see this idea put into practice.