Users suffering password overload

The average corporate IT user is being asked to remember an increasing number of passwords and is resorting to insecure ways to remember them, thus opening the IT infrastructure to risk and placing a heavy burden on help desks, according to a recent survey.

Conducted for Bedford, Mass.-based authentication and encryption company RSA Security by research group Current Analysis, the survey of 1,700 enterprise technology end users in the U.S. showed 30 per cent of users are required to remember six to 12 passwords at work, and 23 per cent need to remember 15 or more. And to remember them, 25 per cent store a master list on their computer, 22 per cent on a PDA or handheld, and 15 per cent keep a paper list by their desk.

Victor DeMarines, RSA’s senior product manager, said the upward trend in the number of passwords wasn’t a surprise, but the sheer numbers that the burden has reached was. He added that the results confirmed that compliance audits have caused companies to increase their password policies and enforcement, requiring passwords to be changed more often and be more complex.

“When you contrast that with the number of passwords they’re managing, you can see it becomes a really complex environment for the end user,” said DeMarines.

User angst is simmering, with 88 per cent of respondents classifying their password situation from somewhat frustrating to very frustrating. And with 82 per cent of users saying restoring a forgotten password requires help desk intervention, it’s also frustrating for the IT department.

Rather than securing the IT infrastructure, DeMarines said harsher password enforcement is only encouraging risky behaviour, such as lists on PDAs, and companies need to find a balance.

He said companies should look at tweaking their policies, or consider technology answers like enterprise single sign-on (ESSO) that let users access multiple applications through one password.

As Philadelphia law firm Post and Schell began to reassess its physical and IT security procedures to comply with government regulations, chief technology officer Louis Mazzio said it quickly became clear that without help, the situation would become unmanageable for their users.

Mazzio said as they moved to electronic documents they wanted to have the same security they had with their locked file cabinet room. Using technology from RSA, Mazzio said each employee now has one smart card with their photo that acts as their company ID as well as their building, elevator and office key card. Each computer has an attached card reader, and combined with their password it gives the user access to areas of the network they’re authorized to use.

Joe Greene, vice-president of IT security research for IDC Canada in Ottawa, said identity and access management are key components to any sound security program. Many people still tend to use simple passwords they can remember, like their kids’ names or birthdays, and he said that can be a problem.

“It drives me nuts, I’ve got I don’t know how many passwords and you can only come up with so many that you can remember and then you’ve got to start writing them down,” said Greene. “But if you have one for everything and someone compromises that, then you’re in trouble.”

Greene said he thinks medium and large companies are starting to pay attention to password security issues, driven partly by issues like compliance requirements. Depending on the legislation, he said it’s important companies know who has access to what information, and that there’s a paper trail.

“That’s how people are going to start coming to grips with these things,” said Greene. “I think you’re going to start seeing identity and access tools being used for (compliance), and over time, a secondary benefit could be password management.”

QuickLink 058155

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Jeff Jedras
Jeff Jedras
As an assistant editor at IT World Canada, Jeff Jedras contributes primarily to CDN and, covering the reseller channel and the small and medium-sized business space.

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now