{"id":208833,"date":"2017-11-04T19:00:47","date_gmt":"2017-11-04T17:00:47","guid":{"rendered":"https:\/\/businesstech.co.za\/news\/?p=208833"},"modified":"2017-11-03T15:47:02","modified_gmt":"2017-11-03T13:47:02","slug":"8-hard-truths-you-have-to-face-about-your-employees-and-password-security","status":"publish","type":"post","link":"https:\/\/businesstech.co.za\/news\/business\/208833\/8-hard-truths-you-have-to-face-about-your-employees-and-password-security\/","title":{"rendered":"8 hard truths you have to face about your employees and password security"},"content":{"rendered":"

LastPass has released The Password Expos\u00e9<\/a><\/strong> report, highlighting the challenges of using passwords in the workplace.<\/p>\n

According to the report, the standard approach to password security in the workplace has failed, and businesses aren’t responding to that failure quick enough.<\/p>\n

“For most people, the fear of forgetting a password far outweighs the seemingly remote risk of getting hacked,” the group said.<\/p>\n

According to its data – from analysing an anonymised data from over 30,000 companies – 91% of employees understand that there is great risk involved with reusing passwords, yet 61% continue to reuse passwords anyway.<\/p>\n

“Whether passwords are old, weak, reused, or compromised – password mismanagement is the leading cause of breaches. With over 4.2 billion credentials leaked in 2016 alone, attackers can easily use stolen passwords to access a corporate network and steal data,” the group said.<\/p>\n

“Just one reused password can compromise an entire organization.”<\/p>\n

LastPass said that passwords are a core part of an employee’s daily workflow, and it was time to look past assumptions and face the fact. To that end, it provided\u00a0\u201c8 truths\u201d about employee passwords that companies need to know:<\/p>\n

\n

1. Passwords are everyone\u2019s problem<\/strong><\/p>\n

LastPass estimates that the average 250-employee company will have around 47,750 passwords used across the entire organisation.<\/p>\n

That creates 47,750 possible entry points into the company’s systems – and no one can know the strength of each one.<\/p>\n

“The numbers don’t lie – passwords are out of control,” it said.<\/p>\n

\n

2. Employees are overwhelmed by passwords<\/strong><\/p>\n

According to LastPass’ data, the average employee has to keep track of around 191 passwords. Industry standards point to a lower number (27), but the group said that people tend to underestimate the number of accounts they have online.<\/p>\n

Marketers have passwords for a large number of analytics platforms, admins gave passwords for each server they manage etc.<\/p>\n

This is not including the personal accounts each employee has.<\/p>\n

\n

3. Passwords are a compounding problem<\/strong><\/p>\n

While employees start off with around 20 passwords stored up in their vaults, this doubles within three months, LastPass said.<\/p>\n

This has led to 61% of people using the same or similar password across the net.<\/p>\n

“Employees are drowning in passwords right now. And it\u2019s a problem that continues to worsen in the course of their day-to-day work,” it said.<\/p>\n

\n

4. Employees are constantly logging in<\/strong><\/p>\n

On average, an employee must type out credentials to authenticate to their websites and apps 154 times a month.<\/p>\n

Pushing the data further, LastPass said that the average employee spends 36 minutes a month just typing in passwords – not including recovery processes which eats away even more time.<\/p>\n

“Employees are suffering from password-related inefficiencies, which translate directly to a company’s bottom line.”<\/p>\n

\n

5. Approved or not, password sharing is common<\/strong><\/p>\n

On average, an employee shares about 4 items with others, according to LastPass’ data.<\/p>\n

Common security advice is to keep passwords private \u2013 in the workplace, though, sharing of credentials and other sensitive data is also an essential part of getting the job done.<\/p>\n

From branded social media accounts managed by marketing to server configurations managed by IT, employees from all departments need to share passwords.<\/p>\n

\n

6. It\u2019s a blurry line between personal and business passwords<\/strong><\/p>\n

There is increasingly a crossover between personal and business applications from big companies (Google, Dropbox, etc), which is blurring the lines between business and personal use.<\/p>\n

Employees may be storing business-related information in personal accounts and vice versa, LastPass said.<\/p>\n

\n

7. Single sign-on (SSO) is not a one-stop solution for passwords<\/strong><\/p>\n

While many enterprise-grade apps are SSO ready, LastPass’ data shows that over 50% of the most popular websites and services in use do not have out-of-the-box support for SSO.<\/p>\n

Either IT teams need to pick up the burden of configuring and deploying these services, or, more likely, employees are left to manage those credentials on their own.<\/p>\n

By sacrificing that control and visibility, IT is again leaving those entry points vulnerable to poor password hygiene and employee misuse.<\/p>\n

\n

8. Not enough businesses are using multi-factor authentication<\/strong><\/p>\n

Only 26.5% of businesses have enabled multi-factor authentication to protect their password vaults – though the trend is growing.<\/p>\n

However, multi-factor authentication doesn\u2019t solve all of your password security challenges, LastPass said.<\/p>\n

Unless multi-factor authentication is enabled for every single login in use across the organization (including all 191 in use by the average employee), passwords are often still a low-barrier, high-value target for attackers looking to find a way in.<\/p>\n

\n

According to LastPass, companies need to build a better framework for password visibility and control. This includes:<\/p>\n

    \n
  1. Randomising every password for every account.<\/li>\n
  2. Rotating passwords when appropriate.<\/li>\n
  3. Applying role-based permissions to passwords.<\/li>\n
  4. Achieving proper oversight and accountability for shared credentials.<\/li>\n
  5. Adding protection with multi-factor authentication wherever possible.<\/li>\n
  6. Decommissioning employee credentials after they leave or change roles.<\/li>\n<\/ol>\n
    \n

    Read:\u00a0Ten critical areas to strengthen your security position and risk mitigation strategies<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

    LastPass has released The Password Expos\u00e9 report, highlighting the challenges of using passwords in the workplace.<\/p>\n","protected":false},"author":10,"featured_media":48856,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9872],"tags":[],"class_list":["post-208833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business"],"_links":{"self":[{"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/posts\/208833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/comments?post=208833"}],"version-history":[{"count":2,"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/posts\/208833\/revisions"}],"predecessor-version":[{"id":208855,"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/posts\/208833\/revisions\/208855"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/media\/48856"}],"wp:attachment":[{"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/media?parent=208833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/categories?post=208833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/businesstech.co.za\/news\/wp-json\/wp\/v2\/tags?post=208833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}