Who knew it was this easy?
A Babe and a Hershey Bar and the World is Yours...
Two thirds of workers reveal passwords for chocolate and a pretty smile
17/04/2007A survey by Infosecurity Europe of 300 office workers and IT professionals has found that 64% were prepared to give their passwords in exchange for a bar of chocolate and a smile.
The survey also found that 67% thought that someone else in their organisation knew their CEO’s password with the most likely candidate being the secretary or PA. The survey was carried out to find out how easy it was to extract peoples work passwords using social engineering techniques with literally just the offer of a chocolate bar for taking part in a survey.
The survey was carried out amongst commuters in London Stations and also at an IT exhibition full of computer professionals just to see how much more security savvy they were compared with the average worker. The survey found that it took a little more probing and a bit more coercion than the average office worker, but even the IT professional eventually succumbed to the questions of the attractive researcher who still managed to extract their passwords in exchange for a smile and a chocolate bar!
The researchers asked the delegates if they knew what the most common password is and then asked them what their password was. Only 22% of IT professionals revealed their password at this point compared to 40% of commuters, if at first they refused to give their password the researchers would then ask if it was based on a child, pet, football team, etc, and then suggest potential passwords by guessing the name of their child or team. By using this technique, a further 42% of IT professionals and 22% of commuters then inadvertently revealed their password. This then took the total number of people who revealed their password to 64% overall for both groups.
What many of IT professionals failed to realise is that the researchers, who conducted the survey at the IT exhibition, had also read their names and organisation from their delegate badge as well! The survey found that 20% of organisations no longer use passwords, with 5% using biometric technology and tokens for identity and access management and a further 15% using tokens. The average number of passwords used at work was 5 per person, with some using as many as 20.
The frequency of changing passwords was 71% monthly, 10% rarely and 20% never as they used biometrics and tokens instead. Some of the IT professionals said that the real issue was not user passwords but the passwords on servers or buried in applications which were never changed as the consequence of changing them on the overall company IT system was unknown and there was a fear that if they were changed a critical part of the system could crash. Some other IT experts said that they often come across servers on which the administrator password was left blank.
When asked if they knew any of their colleagues passwords 29% admitted that they did. A person should never need to give their password to someone claiming to be from the IT department but 39% said that they would give their password to someone who called them from the IT department. They would not be quite so trusting if asked by their boss as only 32% said they would be prepared to give their password if asked.
When asked about confidential information two thirds said that they would look at a file containing everyone’s salary details if they were sent it by mistake and 20% said they would pass it on to colleagues. A third said that they would keep it confidential, with many of them also saying that their IT systems tracked everything they looked at and if they passed this type of information on to anyone it would mean instant dismissal. When asked if they would take any contacts or competitive information with them when they left their jobs, 58% said that they would.
One senior sales manager said I left my job last week and took my whole pipeline with me.Just under half of people used the same password they used for their corporate access for all their personal web accounts such as online banking, retailing, and email. When asked if they felt safe using online banking half said that they did but only a fifth said they felt safe using online retailing but this figure rose to 52% if the retail site was a well know reputable one.S
am Jeffers, Event Manager for Infosecurity Europe 2007 the number one event dedicated to information security which takes place at Olympia, London from 24th to 26th April 2007 said, “This survey shows that even those in responsible IT positions in large organisations are not as aware as they should be about information security. What is most surprising is that even when the IT professionals became slightly wary about revealing their passwords, they were put at their ease by a smile and a bit of smooth talk.
It just goes to show that we still have a long way to go in educating people about security policies and procedures as the person trying to steal data from a company is just as likely to be an attractive young woman acting as a honey trap as a hacker using technology to find a way into a corporate network.
The free education programme at Infosecurity Europe covers all the key issues of keeping information secure and there is a keynote dedicated to Identity Management”.At Infosecurity Europe 2007 Lord Erroll will lead a panel debate on Identity Management examining how to pick the right tools for the job. The panellists will include Toby Stevens, Vice Chairman, BCS Security Forum, Andy Kellett, Senior Research Analyst, Butler Group and Maury Shenk, Partner, Steptoe and Johnson LLP and Head of European Legal Programme SANS.
The keynote, which is free to attend for Infosecurity Europe visitors, takes place at 3:15 pm on Tuesday 24th April 2007.Andy Kellett, Senior Research Analyst, Butler Group commented on the issue of Identity and Access Management (IandAM) “Today, if there is one justified criticism of the IandAM sector, it is that the complete service-delivery model is too complex for most organisations to handle from a standing start. End-to-end projects that have been put forward to deal with all IandAM control issues have often proved to be unrealistic, and indeed, for some, far too difficult to achieve.
Whereas organisations that have taken a more structured and prioritised approach to the IandAM service delivery model, have and do achieve better results in the long run.”Infosecurity Europe is the number one event dedicated to information security. With over 300 exhibitors, the event is the most comprehensive showcase for the most diverse range of new and innovative products and services from the World’s top information security experts and vendors. The event enables security professionals and business managers to establish a commercial justification for information security, refine their security policies and select the most appropriate solutions to support their security strategy in order to safeguard their company’s reputation and assets.
Over 11,000 visitors are expected to attend this year’s event with many travelling from overseas to participate in the FREE education programme that addresses both strategic and technical issues drawing on the skills and experience of senior end users, technical experts and real world case studies. Infosecurity Europe takes place at the Grand Hall, Olympia, London from 24th to 26th April 2007.
www.infosec.co.uk
Two thirds of workers reveal passwords for chocolate and a pretty smile
17/04/2007A survey by Infosecurity Europe of 300 office workers and IT professionals has found that 64% were prepared to give their passwords in exchange for a bar of chocolate and a smile.
The survey also found that 67% thought that someone else in their organisation knew their CEO’s password with the most likely candidate being the secretary or PA. The survey was carried out to find out how easy it was to extract peoples work passwords using social engineering techniques with literally just the offer of a chocolate bar for taking part in a survey.
The survey was carried out amongst commuters in London Stations and also at an IT exhibition full of computer professionals just to see how much more security savvy they were compared with the average worker. The survey found that it took a little more probing and a bit more coercion than the average office worker, but even the IT professional eventually succumbed to the questions of the attractive researcher who still managed to extract their passwords in exchange for a smile and a chocolate bar!
The researchers asked the delegates if they knew what the most common password is and then asked them what their password was. Only 22% of IT professionals revealed their password at this point compared to 40% of commuters, if at first they refused to give their password the researchers would then ask if it was based on a child, pet, football team, etc, and then suggest potential passwords by guessing the name of their child or team. By using this technique, a further 42% of IT professionals and 22% of commuters then inadvertently revealed their password. This then took the total number of people who revealed their password to 64% overall for both groups.
What many of IT professionals failed to realise is that the researchers, who conducted the survey at the IT exhibition, had also read their names and organisation from their delegate badge as well! The survey found that 20% of organisations no longer use passwords, with 5% using biometric technology and tokens for identity and access management and a further 15% using tokens. The average number of passwords used at work was 5 per person, with some using as many as 20.
The frequency of changing passwords was 71% monthly, 10% rarely and 20% never as they used biometrics and tokens instead. Some of the IT professionals said that the real issue was not user passwords but the passwords on servers or buried in applications which were never changed as the consequence of changing them on the overall company IT system was unknown and there was a fear that if they were changed a critical part of the system could crash. Some other IT experts said that they often come across servers on which the administrator password was left blank.
When asked if they knew any of their colleagues passwords 29% admitted that they did. A person should never need to give their password to someone claiming to be from the IT department but 39% said that they would give their password to someone who called them from the IT department. They would not be quite so trusting if asked by their boss as only 32% said they would be prepared to give their password if asked.
When asked about confidential information two thirds said that they would look at a file containing everyone’s salary details if they were sent it by mistake and 20% said they would pass it on to colleagues. A third said that they would keep it confidential, with many of them also saying that their IT systems tracked everything they looked at and if they passed this type of information on to anyone it would mean instant dismissal. When asked if they would take any contacts or competitive information with them when they left their jobs, 58% said that they would.
One senior sales manager said I left my job last week and took my whole pipeline with me.Just under half of people used the same password they used for their corporate access for all their personal web accounts such as online banking, retailing, and email. When asked if they felt safe using online banking half said that they did but only a fifth said they felt safe using online retailing but this figure rose to 52% if the retail site was a well know reputable one.S
am Jeffers, Event Manager for Infosecurity Europe 2007 the number one event dedicated to information security which takes place at Olympia, London from 24th to 26th April 2007 said, “This survey shows that even those in responsible IT positions in large organisations are not as aware as they should be about information security. What is most surprising is that even when the IT professionals became slightly wary about revealing their passwords, they were put at their ease by a smile and a bit of smooth talk.
It just goes to show that we still have a long way to go in educating people about security policies and procedures as the person trying to steal data from a company is just as likely to be an attractive young woman acting as a honey trap as a hacker using technology to find a way into a corporate network.
The free education programme at Infosecurity Europe covers all the key issues of keeping information secure and there is a keynote dedicated to Identity Management”.At Infosecurity Europe 2007 Lord Erroll will lead a panel debate on Identity Management examining how to pick the right tools for the job. The panellists will include Toby Stevens, Vice Chairman, BCS Security Forum, Andy Kellett, Senior Research Analyst, Butler Group and Maury Shenk, Partner, Steptoe and Johnson LLP and Head of European Legal Programme SANS.
The keynote, which is free to attend for Infosecurity Europe visitors, takes place at 3:15 pm on Tuesday 24th April 2007.Andy Kellett, Senior Research Analyst, Butler Group commented on the issue of Identity and Access Management (IandAM) “Today, if there is one justified criticism of the IandAM sector, it is that the complete service-delivery model is too complex for most organisations to handle from a standing start. End-to-end projects that have been put forward to deal with all IandAM control issues have often proved to be unrealistic, and indeed, for some, far too difficult to achieve.
Whereas organisations that have taken a more structured and prioritised approach to the IandAM service delivery model, have and do achieve better results in the long run.”Infosecurity Europe is the number one event dedicated to information security. With over 300 exhibitors, the event is the most comprehensive showcase for the most diverse range of new and innovative products and services from the World’s top information security experts and vendors. The event enables security professionals and business managers to establish a commercial justification for information security, refine their security policies and select the most appropriate solutions to support their security strategy in order to safeguard their company’s reputation and assets.
Over 11,000 visitors are expected to attend this year’s event with many travelling from overseas to participate in the FREE education programme that addresses both strategic and technical issues drawing on the skills and experience of senior end users, technical experts and real world case studies. Infosecurity Europe takes place at the Grand Hall, Olympia, London from 24th to 26th April 2007.
www.infosec.co.uk
posted by Mark Mac Auley at 4/19/2007
Get My Identitystuff Newsletter
0 Comments:
Post a Comment
<< Home