Passwords are fundamental to any
IT
security
system, yet many organisations still fall at the first security
hurdle, says Cyber-Ark.
The survey of 175
IT
professionals at Infosecurity
Europe 2005 found that only 32% of respondents stored passwords
digitally, while the remainder continued to use labour-intensive,
manual processes for storing their passwords. This included the
storage of paper copies anywhere from locked cabinets to physical
safes, hindering efforts for regular and on-demand resetting of
passwords.
Fourteen percent of respondents kept their admin passwords in an
Excel file – which is known to be insecure – while 25% of
IT
staff were able to access admin passwords without
permission, the survey found.
Fifteen percent of respondents from large organisations admitted
that their security practices were never audited and 14% of
respondents admitted that their company had no password change
management policy, which means that they have no way of controlling
who has access to systems, according to Cyber-Ark.
The vaulting solutions firm discovered that nearly 10% of
companies never change their mission critical administrative
passwords and that 5% don't even change the manufacturer's default
password on their systems.
Considering that administrative passwords are the "keys to the
kingdom" and give access to the most confidential information on
the network, this is alarming, says Cyber-Ark.
One
IT
security director who was interviewed for
the survey admitted to keeping all the administrative passwords in
his mobile phone, explaining that he thought this was "a very safe
place".
Tom Crawford, president and
CEO
of Cyber-Ark said:
“Companies can now simplify the management of administrative
passwords by using a digital vault which can securely automate
administrative passwords in a cost-effective and efficient
way."
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
