Password misuse could be root cause of hacking spike 17 October, 2011 By Mark Cox

PromoPipeline Exclusive Channel Promotions Find Out How You Can Make Money Today! ENROLL FREE! >> Special Offer From ChannelLine and CompTIA Robert M. Cohen - Integrated mar.com CompTIA Webinar: How To Profitably Grow Your Business Series: Business Assessment and Developing Effective Business Plans Robert M. Cohen - Integrated mar.com The Emergence of Partner-Led Diane Krakora - PartnerPath To Jabber, Chatter or Lync?  That is the Question Beth Vanni - PartnerPath It's All About You Beth Vanni - PartnerPath

The Password 2011 survey, by Lieberman Software Corporation, found that 48% of IT security professionals surveyed have worked for organizations whose network has been breached by a hacker. It also found considerable chaos amongst IT staff and apathy about password security amongst their senior management.

Many password-related problems were found. 51% of respondents had ten or more passwords to remember for use in their work. 42% of those surveyed said that in their organizations IT staff are sharing passwords or access to systems or applications. 26% said that they were aware of an IT staff member abusing a privileged login to illicitly access sensitive information, And 48% of respondents work at companies that are still not changing their privileged passwords within 90 days -- a violation of most major regulatory compliance mandates and one of the major reasons why hackers are still able to compromise the security of large organizations

For many organizations these weaknesses are the backdoors by which hackers find their way into the enterprise's most sensitive data. If almost 50% of all passwords remain unchanged, as this survey discovered, then fundamental and basic IT security practices are being ignored by staff and their senior management.

Privileged identities are accounts that hold elevated permission to access files, install and run programs, and change configuration settings. Their misuse is a major reason for data leakage.

"This survey shows that despite the huge number of frequent data breaches, over the past twelve months senior management in many organizations have not yet grasped the fundamentals of IT security," said Philip Lieberman, President and CEO of Lieberman Software, said. "In fact they are actively paving the way for more and bigger disasters. "Password anarchy among the IT staff at major organizations is mirrored by password apathy at the top of the management hierarchy, where senior management seem almost criminally lax in the enforcement of IT security policies - to the detriment of their organizations." Lieberman said.

"These fundamentally careless practices and procedures revealed by the IT departments of the organizations we surveyed could cost them dearly in the coming months," Lieberman said.

" We have consistently said that basic security includes locking down access to systems containing sensitive data to minimize the insider threat. However, only months after the Sony, RSA Security and Comodo breaches the situation within major organizations remains at risk," Lieberman added.

"Management will have to pay far more attention to their basic security practices or be forced to apologize to their shareholders and customers for major data losses and subsequent damage to brand loyalty," Lieberman said. "The simple, unpalatable truth is that senior management generally is not policing their IT security departments enough to avoid further massive data breaches."

The survey was conducted by Lieberman Software at HP Protect 2011 amongst more than 300 IT professionals.