News

Study: Weak Passwords Still Main Security Defense

New research finds most organizations still use passwords to protect important data. But the study also says they provide little protection against a breach

By Joan Goodchild, Senior Editor

September 04, 2008 — CSO —

As a security manager, you know how easily passwords can be compromised -- and you are doing all you can to add extra layers of security, right?

If your answer is no, you're not alone. A new study finds most organizations are still relying primarily on passwords to protect important data.

The research, titled "Strong User Authentication," was conducted by Aberdeen Group and commissioned by Quest Software, a provider of enterprise systems management products. It find 52 percent of organizations require only passwords for employees to access critical data, rather than augmenting passwords with stronger forms of authentication such as hardware tokens, digital certificates or risk-based scoring.

The research firm polled nearly 150 organizations around the world, according to Derek Brink, vice president and research fellow for IT Security, Aberdeen Group.

"The fact that passwords are so predominant is probably not a surprise," said Brink. "But a high percentage use only passwords and that is bad because people don't practice really good policy with passwords."

Brink pointed to problems such as weak, short, word choices and poor policies in organizations as reasons why the password alone is now an out-of-date security protocol. In fact, the Aberdeen study found 64 percent of organizations do not even require users to change their passwords, 45 percent allow standard dictionary terms, like "password," and 29 percent of organizations have no requirements for password length.

Even those organizations trying to implement good password policies are running into problems, said Brink. The research found 88 percent of enterprise users have multiple work-related passwords, averaging between five and six.

"That becomes a management problem for users because they have to remember them all and keep them separate," said Brink. "And users typically solve that problem with bad practices, such as writing them down or choosing the same password for all systems."

Brink said more companies should be considering two-factor authentication processes that use software tokens, digital certificates or user biometrics as an additional layer of security.

"We have daily incidents now with regard to people gaining unauthorized access to data," said Jackson Shaw, a senior director of product management with Quest Software. "With the recent, well-publicized incidents of network and identity theft, companies need to put security first and require more than just passwords for user authentication."