Endpoint

Average Employee Manages Nearly 200 Passwords

But single sign-on support lacks in over 50% of the most popular websites and services used by workers.

Employees use an average of 191 passwords to enter 154 times in a given month, racking up an estimated 36 minutes of password data entry during that time, according to a report released today.

The Password Exposé report, based on aggregated and anonymized data from over 30,000 LastPass customers, found that other industry reports often underestimate the number of credentials used and put the figure closer to an average of 27 passwords per employee.

In addition to enterprise apps, employees often use dozens of other apps while at work, such as advertising and analytics platform apps as well as demonstration apps, the report notes.

Meanwhile, companies and employees do not get full relief by using single sign-on (SSO) technology.

Although a number of enterprise apps have SSO capabilities, more than 50% of the most popular websites and services, such as Box, MailChimp, and LinkedIn, do not support SSO out of the box, the report states.

As a result, companies are left to put a business password manager in place to ensure all of those websites and services are "captured" and managed by IT policies, says Rachael Stockton, director of product strategy at LastPass.

Password vaults with multifactor authentication are enabled in 26.5% of the companies included in the report, a level that lacks broad enough adoption to offset the problems that enterprises face with passwords, according to the report.

"Multifactor authentication isn't supported widely enough across Web services, and isn't adopted frequently enough by businesses, to offset the risks that passwords pose," Stockton says. "While the business community is moving in the right direction, change is happening too slowly. Until universal coverage with multifactor authentication (or even behavioral or contextual authentication) is available, companies need to invest in strengthening the password-protected services in use across the entire organization."

Another recent study found that while corporate America's use of passwords remains prevalent, multifactor authentication is showing some signs of growth in the enterprise. Javelin Strategy & Research's 2017 State of Authentication Report found 100% of enterprises continue to use passwords, despite industry calls to ditch them all together or at least bolster security through a combination of passwords and other measures, such as biometrics and public key infrastructure.

Password vaults also grow exponentially, the study found. The average employee starts with 20 credentials in their password vault and within three months that number doubles, according to the report.

LastPass, in a report from last year, found that 91% of users were aware of the risks of reusing passwords, yet 61% continued with the practice.

Business and Personal Password Use Intermingled
Roughly half of the top 36 popular websites that employees access for work are consumer solutions, such as Dropbox, Google, and Evernote, the report states. But the owners of these accounts are likely the employees, even though sensitive work-related data is likely stored on these accounts.

"The line between 'business' and 'personal' apps is a blurry one. People are often using personal accounts in the workplace, and may even be doing work or sharing work data in those personal accounts," says Stockton.

The report also points to a recent Ovum study that found 23% of workers will use their social media credentials to log into business systems and applications, as well.

"It was very surprising to learn that businesses were allowing access to their data through sites protected only by personal passwords that they have no control over," Stockton adds.

In citing the problems with this practice, Stockton says the first one is control. When an organization allows an employee to log in via Facebook, then it is leaving all the password policy control, such as two-factor authentication, password rotation, and number of characters to the end user and raises the risk that a weak password is protecting access to critical business data, she says.

The second risk, Stockton observes, is that social media credentials are often reused and not very secure.

"If one social media website has a security incident, there's increased risk that attackers will find re-used credentials to access corporate accounts," she says. "You are basically outsourcing the password security for your company to another website."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SethRuden
50%
50%
SethRuden,
User Rank: Author
11/8/2017 | 12:59:09 PM
Re: Password management solutions
Service Provider authenticators will be forced to change or embrace the reputation risk of being a perpetuator of a zombie technologhy
craigk944
50%
50%
craigk944,
User Rank: Apprentice
11/3/2017 | 2:22:02 PM
191 Passwords - I have my doubts.
"How many unique passwords?" is the question.  The word unique is nowhere in the report. If you use the word "fred" as a password and have google save it for 50 websites, is that one password or fifty?   craig kensek
RussD653
100%
0%
RussD653,
User Rank: Strategist
11/2/2017 | 10:04:08 AM
Password management solutions
I for one use LastPass for my families passwords and management of the massive number of logins we have.

There is really no way to manage your personal passwords and logins without a combinations of solutions, like LastPass for the vault and Auth for two factor authentication.

 
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.