Why do we have such a hard time with passwords? Here’s the answer

Mem­o­ry remains some­thing of a mys­tery. Neu­ro­sci­en­tists every­where are work­ing to unlock the secrets of human mem­o­ry, many of which con­tin­ue to elude us. But one the­o­ry posits that we don’t usu­al­ly remem­ber our orig­i­nal mem­o­ries – we remem­ber the last time that we remem­bered them, like copies of copies of copies.

The nature of our dig­i­tal lives neces­si­tates that we cre­ate more com­pli­cat­ed, unique com­bi­na­tions of let­ters, spaces, phras­es, upper-case, low­er-case, signs and sym­bols in order to access the ser­vices we rely on at home and at work. These are only grow­ing: a recent study from Last­Pass shows 90% of peo­ple have as many as 50 online accounts. Giv­en our time-pressed lives, is it any won­der that, even in 2022, the top five most com­mon pass­words leaked to the dark web were ‘123456’, ‘12345678’, ‘Qwer­ty’, ‘Pass­word’, and ‘12345’?

While 90% of inter­net users are wor­ried about hav­ing their cre­den­tials stolen, a stag­ger­ing 83% wouldn’t know if their pass­words had been leaked to the dark web. The major­i­ty of peo­ple reuse pass­words across accounts, and 45% don’t change pass­words even after a known breach – leav­ing per­son­al accounts and organ­i­sa­tions wide open to attack. In terms of user safe­ty, there’s clear­ly a mis­match at play here: while users cor­rect­ly per­ceive the dan­ger of cre­den­tials theft, they’re not doing any­thing about it.

Today, a sin­gle com­pro­mised account can eas­i­ly cre­ate a dis­as­trous domi­no effect where not only the orig­i­nal tar­get suf­fers, but so do their con­tacts, sup­pli­ers, and every­one else in their wider net­work – in fact, recy­cled pass­words are often the first point of entry into con­duct­ing a suc­cess­ful sup­ply-chain attack. Finan­cial and rep­u­ta­tion­al dam­age can eas­i­ly spi­ral out of con­trol, and one stolen cre­den­tial is all it might take.

In spite of their ubiq­ui­ty – the pass­word has, after all, been with us since the ear­li­est days of com­put­ing – pass­words remain a fun­da­men­tal weak spot. Ulti­mate­ly, they rely on end-user choice. Secu­ri­ty teams can imple­ment some mea­sures, but they are lim­it­ed in the guid­ance they can real­ly enforce, or the tech­ni­cal guardrails they can install. Weak or recy­cled pass­words are a case of human fal­li­bil­i­ty, and that’s unlike­ly to change pro­vid­ed humans remain fal­li­ble. Which we will.

Attack­ers are all too aware of these vul­ner­a­bil­i­ties in human psy­chol­o­gy and so secu­ri­ty teams need to be too. Peo­ple haven’t evolved to mem­o­rise fre­quent­ly chang­ing gen­er­at­ed pass­words – it’s just not some­thing that’s been a part of our evo­lu­tion­ary his­to­ry.

So while it’s true that every user has a role to play in the safe­ty of their organ­i­sa­tion, it’s not pos­si­ble or even desir­able that every­one becomes a secu­ri­ty-obsessed pass­word expert. It’s up to organ­i­sa­tions to imple­ment safe­guards, main­tain­ing a bal­ance between usabil­i­ty, secu­ri­ty, and keep­ing the onus of respon­si­bil­i­ty away from weigh­ing too heav­i­ly on the user.
But the idea that peo­ple are a ‘weak link’ in secu­ri­ty is per­haps an unfair mis­nomer. Peo­ple are peo­ple, and as such, sys­tems should be built around their blind spots, pat­terns, or bad habits to help guard against them. That’s why it’s so impor­tant to under­stand the psy­chol­o­gy at play.

“As humans, we have finite cog­ni­tive resources that we use to nav­i­gate our every­day lives,” explains char­tered psy­chol­o­gist and pro­fes­sor of psy­chol­o­gy at Bournemouth Uni­ver­si­ty, John McAlaney. “Work­places can be very intense, requir­ing us to pay atten­tion to mul­ti­ple things at once – we are con­tin­u­al­ly in a state of hav­ing to pri­ori­tise.”

Pic­ture being on a dri­ve and spot­ting flash­ing lights in your rearview mir­ror. It’s an emer­gency vehi­cle, and you reflex­ive­ly pre­pare to move aside – a quick, impul­sive deci­sion, but the cor­rect one. These intu­itive reflex­es are often a strength, but they can be a weak­ness too: “Some­times mak­ing a quick deci­sion based on lim­it­ed infor­ma­tion will result in an incor­rect deci­sion,” says McAlaney, “and this could be the case with pass­word safe­ty.”

If an indi­vid­ual is jug­gling a lot of tasks, they may not pri­ori­tise secu­ri­ty. This “doesn’t mean they don’t under­stand its impor­tance or are being lazy,” McAlaney adds, “it’s often just the case peo­ple feel they have many oth­er tasks that need to be done with lim­it­ed resources.”

Bolt­ing the ‘dig­i­tal doors’
For­tu­nate­ly, there are both tech­ni­cal and cul­tur­al ini­tia­tives that organ­i­sa­tions can take to make our dig­i­tal lives a lit­tle more secure. In our homes, it only takes an intrud­er one entry point to pry open access every­where. In the dig­i­tal world, the same is true, but at a far larg­er scale: one set of stolen cre­den­tials could leave your whole organisation’s net­work open for attack.

With good rea­son, it’s socialised into us to lock the doors and win­dows when we leave our homes. A sin­gle pin tum­bler lock is wor­ry­ing­ly sim­ple for any would-be intrud­ers to pick, and that’s why most homes rein­force front and back doors with more secure sys­tems like dead­bolts. A sim­ple plain­text pass­word is the dig­i­tal equiv­a­lent of that pin tum­bler. It’s a deter­rent, but eas­i­ly cracked.

But dead­lier still are default pass­words. Inter­net-con­nect­ed devices on your net­work, includ­ing routers or CCTV sys­tems, will often ship with default pass­words enabled. Leav­ing these in place means you’re “basi­cal­ly leav­ing your keys in the door,” says pro­fes­sor of cyber secu­ri­ty at Ulster Uni­ver­si­ty, Kevin Cur­ran. “There are search engines like Shodan which crawl the web for con­nect­ed Inter­net of Things devices, and hack­ers will try defaults on all of them.”

The num­ber one rule, then, is to use dif­fer­ent pass­words – all the time, every­where. “One should have a rep­utable pass­word man­ag­er which will cre­ate com­plex, strong pass­words,” Cur­ran com­ments. These are then stored in an encrypt­ed vault. “You then only need to remem­ber one mas­ter pass­word, and the pass­word man­ag­er will auto­mat­i­cal­ly take care of log­ging you into dif­fer­ent sites with secure pass­words.”

How­ev­er, pass­word man­agers only work if indi­vid­u­als ful­ly trust them to gen­er­ate and safe­ly store pass­words – and users need to have them installed on every device they use to access their accounts, points out CIO of Enda­va, Hele­na Nim­mo. LastPass’s busi­ness pass­word man­ag­er, for exam­ple, pro­tects all end­points across the organ­i­sa­tion, wher­ev­er employ­ees work, with full con­trol for IT over deploy­ment and poli­cies. Sug­gest­ing and man­ag­ing unique, strong pass­words, the secure man­ag­er reduces the num­ber of pass­words employ­ees have to remem­ber and, as such, helps mit­i­gate poor pass­word hygiene.

Organ­i­sa­tions can improve pass­word secu­ri­ty by com­bin­ing mul­ti­ple approach­es. Encour­ag­ing employ­ees not to share pass­words across per­son­al and com­pa­ny accounts, and sug­gest­ing employ­ees use sen­tences, for length­i­er pass­words, is a good start.
“Secur­ing the pass­word man­age­ment process with mul­ti-fac­tor authen­ti­ca­tion, which relies on a PIN or bio­met­rics, and mak­ing sure that pass­words are changed reg­u­lar­ly by every­one with­in the organ­i­sa­tion, with­out excep­tion, are also good prac­tice,” says Nim­mo.

Mea­sures like these can fit into a ‘cyber­se­cu­ri­ty by design’ frame­work, says Cur­ran, where secu­ri­ty staff help to craft a set of prag­mat­ic guide­lines so that organ­i­sa­tions can more com­plete­ly con­sid­er the full remit of pro­tec­tions and process­es that should be in place.
Busi­ness­es need to have a holis­tic under­stand­ing of cyber­se­cu­ri­ty as an organ­i­sa­tion-wide risk, along with all their legal and reg­u­la­to­ry impli­ca­tions, and pass­word aware­ness is part of this. Organ­i­sa­tions should train staff, iden­ti­fy which risks to avoid, accept, and mit­i­gate, and com­mu­ni­cate busi­ness-wide pol­i­cy to senior man­age­ment.

How­ev­er, even with train­ing, it can often take peo­ple to make a mis­take them­selves before they learn. Secu­ri­ty teams could con­sid­er send­ing phish­ing emails con­tain­ing fake mal­ware to employ­ees, which, when acti­vat­ed, edu­cate them on their mis­takes.

Cul­tur­al­ly, employ­ees take their cues from lead­er­ship, adds McAlaney, so if they feel senior man­age­ment are only pay­ing lip ser­vice to secu­ri­ty, staff are less like­ly to invest in the top­ic them­selves. Lead­er­ship need to prac­tice what they preach as well as train­ing staff.

Increas­ing knowl­edge doesn’t nec­es­sar­i­ly lead to behav­iour change, and this is where a lot of edu­ca­tion ini­tia­tives fall down: mere­ly hav­ing employ­ees sit through a sem­i­nar or online course is not nec­es­sar­i­ly going to make any­one behave more secure­ly. Knowl­edge helps, but it doesn’t defin­i­tive­ly trans­late into action.

“Instead, you need to under­stand what bar­ri­ers are pre­vent­ing the employ­ees from chang­ing their behav­iour, such as the con­flict between the need for secu­ri­ty ver­sus the pres­sure to be pro­duc­tive,” says McAlaney.

“If an organ­i­sa­tion finds half their staff did not change pass­words after a breach, then the first step should be to open a gen­uine, non-judge­men­tal, dia­logue with employ­ees to find out what’s stop­ping them from mak­ing these changes – then find­ing a way for­ward tak­ing these issues into account.”

For more infor­ma­tion, vis­it lastpass.com

Six tips to guard your ‘digital doors’

There’s no fool-proof way to pro­tect any organ­i­sa­tion, but keep­ing some prin­ci­ples in mind – from cul­ture through to tech­nol­o­gy, imple­men­ta­tion, and ongo­ing main­te­nance – can go a long way to help.

1. Embed secu­ri­ty in your cul­ture. Cre­ate a cul­ture where all lev­els of the organ­i­sa­tion under­stand and val­ue secu­ri­ty, and where staff feel com­fort­able report­ing mis­takes. How­ev­er, accept that rais­ing aware­ness is not always enough to change behav­iour, advis­es Bournemouth University’s John McAlaney. Busi­ness­es can hit a wall if they think secu­ri­ty cul­ture ends at train­ing.

2. Be cyber smart. Phish­ing, smish­ing (text or SMS), and vish­ing (voice call) attacks are on the rise. Care­ful­ly review any mes­sages you receive by dou­ble-check­ing the sender’s email address. Be on the look­out for poor­ly writ­ten email copy, and don’t blind­ly accept any MFA requests.

3. Set up your cyber­se­cu­ri­ty tools. Tech­nol­o­gy makes secur­ing you and your data a lot eas­i­er. Imple­ment­ing solu­tions like a pass­word man­ag­er and mul­ti-fac­tor authen­ti­ca­tion (MFA) will secure your data and bol­ster best prac­tices.

4. Update your soft­ware. Cyber­at­tacks often tar­get vul­ner­a­bil­i­ties in old­er appli­ca­tions. If you receive an alert from Apple, Microsoft, or Google about an urgent secu­ri­ty update, install it right away. The same applies to smart home devices or oth­er Inter­net of Things (IoT) gad­gets.

5. Con­duct an audit. Do you know where your data is? Is every piece of infor­ma­tion pro­tect­ed? Have you shared any sen­si­tive cre­den­tials? Try to map out where your data is, who might have access to your infor­ma­tion, and take a dig­i­tal head­count.

6. Trust your gut. If mon­ey or high­ly sen­si­tive infor­ma­tion (like your Nation­al Insur­ance num­ber) is request­ed – and the sender needs it quick­ly – take a moment to assess the sit­u­a­tion. Don’t be afraid to ask ques­tions and get all the facts before press­ing send.

or more infor­ma­tion, vis­it lastpass.com

Pro­mot­ed by Last­Pass