Passwords are fundamental to any IT security system, yet many organisations still fall at the first security hurdle, says Cyber-Ark.
The survey of 175 IT professionals at Infosecurity Europe 2005 found that only 32% of respondents stored passwords digitally, while the remainder continued to use labour-intensive, manual processes for storing their passwords. This included the storage of paper copies anywhere from locked cabinets to physical safes, hindering efforts for regular and on-demand resetting of passwords.
Fourteen percent of respondents kept their admin passwords in an Excel file – which is known to be insecure – while 25% of IT staff were able to access admin passwords without permission, the survey found.
Fifteen percent of respondents from large organisations admitted that their security practices were never audited and 14% of respondents admitted that their company had no password change management policy, which means that they have no way of controlling who has access to systems, according to Cyber-Ark.
The vaulting solutions firm discovered that nearly 10% of companies never change their mission critical administrative passwords and that 5% don't even change the manufacturer's default password on their systems.
Considering that administrative passwords are the "keys to the kingdom" and give access to the most confidential information on the network, this is alarming, says Cyber-Ark.
One IT security director who was interviewed for the survey admitted to keeping all the administrative passwords in his mobile phone, explaining that he thought this was "a very safe place".
Tom Crawford, president and CEO of Cyber-Ark said: “Companies can now simplify the management of administrative passwords by using a digital vault which can securely automate administrative passwords in a cost-effective and efficient way."
