A survey by Infosecurity Europe of 300 office workers and IT professionals has found that 64% were prepared to give their passwords in exchange for a bar of chocolate and a smile. The survey also found that 67% thought that someone else in their organisation knew their CEO’s password with the most likely candidate being the secretary or PA. The survey was carried out to find out how easy it was to extract peoples work passwords using social engineering techniques with literally just the offer of a chocolate bar for taking part in a survey.
The survey was carried out amongst commuters in London Stations and also at an IT exhibition full of computer professionals just to see how much more security savvy they were compared with the average worker.
The survey found that it took a little more probing and a bit more coercion than the average office worker, but even the IT professional eventually succumbed to the questions of the attractive researcher who still managed to extract their passwords in exchange for a smile and a chocolate bar!
The researchers asked the delegates if they knew what the most common password is and then asked them what their password was. Only 22% of IT professionals revealed their password at this point compared to 40% of commuters, if at first they refused to give their password the researchers would then ask if it was based on a child, pet, football team, etc, and then suggest potential passwords by guessing the name of their child or team. By using this technique, a further 42% of IT professionals and 22% of commuters then inadvertently revealed their password. This then took the total number of people who revealed their password to 64% overall for both groups. What many of IT professionals failed to realise is that the researchers, who conducted the survey at the IT exhibition, had also read their names and organisation from their delegate badge as well!
The survey found that 20% of organisations no longer use passwords, with 5% using biometric technology and tokens for identity and access management and a further 15% using tokens.
The average number of passwords used at work was 5 per person, with some using as many as 20. The frequency of changing passwords was 71% monthly, 10% rarely and 20% never as they used biometrics and tokens instead. Some of the IT professionals said that the real issue was not user passwords but the passwords on servers or buried in applications which were never changed as the consequence of changing them on the overall company IT system was unknown and there was a fear that if they were changed a critical part of the system could crash. Some other IT experts said that they often come across servers on which the administrator password was left blank.
When asked if they knew any of their colleagues passwords 29% admitted that they did. A person should never need to give their password to someone claiming to be from the IT department but 39% said that they would give their password to someone who called them from the IT department. They would not be quite so trusting if asked by their boss as only 32% said they would be prepared to give their password if asked.
When asked about confidential information two thirds said that they would look at a file containing everyone’s salary details if they were sent it by mistake and 20% said they would pass it on to colleagues. A third said that they would keep it confidential, with many of them also saying that their IT systems tracked everything they looked at and if they passed this type of information on to anyone it would mean instant dismissal. When asked if they would take any contacts or competitive information with them when they left their jobs, 58% said that they would. One senior sales manager said I left my job last week and took my whole pipeline with me.
Just under half of people used the same password they used for their corporate access for all their personal web accounts such as online banking, retailing, and email. When asked if they felt safe using online banking half said that they did but only a fifth said they felt safe using online retailing but this figure rose to 52% if the retail site was a well know reputable one.
Sam Jeffers, Event Manager for Infosecurity Europe 2007, said, “This survey shows that even those in responsible IT positions in large organisations are not as aware as they should be about information security. What is most surprising is that even when the IT professionals became slightly wary about revealing their passwords, they were put at their ease by a smile and a bit of smooth talk. It just goes to show that we still have a long way to go in educating people about security policies and procedures as the person trying to steal data from a company is just as likely to be an attractive young woman acting as a honey trap as a hacker using technology to find a way into a corporate network.”
Andy Kellett, Senior Research Analyst, Butler Group commented on the issue of Identity & Access Management (I&AM) “Today, if there is one justified criticism of the I&AM sector, it is that the complete service-delivery model is too complex for most organisations to handle from a standing start. End-to-end projects that have been put forward to deal with all I&AM control issues have often proved to be unrealistic, and indeed, for some, far too difficult to achieve. Whereas organisations that have taken a more structured and prioritised approach to the I&AM service delivery model, have and do achieve better results in the long run.”
About InfoSecurity Europe:
Infosecurity Europe is a convergence of information security professionals. Showcasing a diverse range of new products and services and addressing today’s strategic and technical issues in an education programme. The event delivers an audience hungry for education and information on how, what, why and when to purchase the products on offer.
Published: Tuesday, April 24, 2007
2.) | Daisee Daisee Daisee builds technology that empowers people to solve problems by making interactions simple and smart so they can have a more significant impact, be more productive and be better at what they do. We believe incremental improvements carry huge potency and provide exponentially greater change for the better. Genesys customers can now automate risk and quality management using Daisee’s speech and sentiment analytics and remediation workflow software. Daisee helps improve customer experience, ensure regulatory compliance, identify missed commercial opportunities & training requirements as well as provide valuable insights back to the business directly from the frontline – the true voice-of-... (read more) |
I am checking out all the amazing and daily updated content on ContactCenterWorld.com and networking with professionals worldwide
Send To Friends Post On My Wall