Did you know the average employee spends over simply inputting passwords? Although 10 hours doesn鈥檛 seem like much in the grand scheme of things, these hours amount to a cost of around in lost time.
This is detrimental to both business productivity and employee wellbeing, not to mention the grave security risks that passwords cause.
Let鈥檚 face it. People are tired of passwords. So much so that the term 鈥減assword fatigue鈥� has been developed to describe modern attitudes towards the login process. But what is password fatigue, exactly? This article will explore both the password problem and potential solutions.
Diagnosing the Problem
In the modern era of IT, advancements into the cloud and the rise of 鈥�as-a-Service鈥� offerings have given organizations incredible capabilities in regards to speed, work location flexibility, and collaboration, among other things. Unfortunately, friction has come alongside these enhancements as well.
On any given workday, in addition to personal accounts, an average employee might log in to dozens of disparate applications or other resources that are critical to their success. There is generally a commonality between each of these logins: a username and password.
A username is fairly easy to remember; it might be an email address, first initial/last name, employee ID number, etc. For most (if not all), there is no such thing as 鈥渦sername fatigue鈥�. Most organizations and individuals know that logging into an IT service is a two-step process and the first step is not required to be unique. It is easy to have a common username that is used virtually everywhere.
The Password Problem
Passwords, on the other hand, are more complicated. Common password requirements enforce that a password can鈥檛 match the username, must be of a certain length, and contain a variety of characters, including upper/lowercase letters, numbers, special characters, and more.
An additional security measure implemented in some organizations is password rotation, which requires employees to change their passwords at set time intervals, such as every 90 days. Security professionals also recommend against password reuse.
With all of these requirements and restrictions, it can be difficult to come up with safe, secure passwords for every IT service and then remember them all.
In an ideal world then, on any given workday, the average employee is expected to remember maybe two or three usernames, and dozens of unique and complex passwords that can be required to change regularly.
Password Fatigue
In reality, the struggle to keep all of these passwords straight turns into password fatigue, which ultimately leads to password simplification and reuse. It is estimated that the average business employee keeps track of .
This is a burden. Employees become tired of having to remember a host of passwords, so they start repeating passwords and reducing complexity in an effort to relieve the mental burden of logging in.
The fear of forgetting a password outweighs the fear of a potential data breach. understand the risk of reusing passwords, yet .
This is a sobering reality, especially when you consider the fact that involve credentials. In short, passwords are the gateway to confidential data, electronic financial transactions, and more, yet we don鈥檛 treat them as the most critical security risk an organization faces. Password fatigue, then, not only affects employees but organizational security as well.
The enterprise is more at risk if its employees are struggling with password fatigue.
According to a survey conducted by the Ponemon Institute, rotate the same five passwords across their work and personal accounts.
In addition to sharing passwords among their own accounts, employees often share passwords with each other; admit to sharing credentials for work account access. In fact, there are tools that encourage 鈥渟ecure鈥� password sharing!
Another potential security risk related to password fatigue is susceptibility to phishing since most password reset requests are delivered by email. Phishing is the most common attack vector and of data breaches.
If an employee experiencing password fatigue was successfully phished, and if they had five passwords in rotation that were shared with another employee, the situation could easily escalate into a serious data breach. Many of the world鈥檚 worst corporate data breaches originated through password breaches – think Sony, Target, and more.
What You Can Do About Password Fatigue
Password fatigue is a serious condition in the modern workplace and more widespread than we鈥檇 like to think. To avoid the negative impacts of password fatigue in your organization, here are a few solutions to consider.
1. Password Managers
Using an SSO password manager is a great way to alleviate password fatigue. Password managers allow employees to create a repository of their various passwords and automatically present them at login windows.
Since employees no longer need to remember every single password, password managers open up a greater possibility for increased length and higher password complexity.
Instead of keeping track of the differences between 鈥淩0cketMan72鈥� or 鈥渞ocKetm4n&@鈥�, employees can simply use a computer-generated string of random characters for their password.
The chances of developing password fatigue decrease significantly. On top of that, with a complex, randomly-generated password, the probability of general password compromise also decreases.
2. Multi-factor Authentication
In the context of password fatigue, multi-factor authentication (MFA) might seem counterintuitive. Wouldn鈥檛 adding an additional step to the login process just make things worse?
Contrary to popular belief, the implementation of a second authentication factor doesn鈥檛 need to be complicated. It can be as simple as a push notification sent to the employee鈥檚 phone that asks them to 鈥楢ccept鈥� or 鈥楧eny鈥� a log-in request.
The Fine Art of Making MFA Palatable
In this webinar recording, learn tips & tricks for maximizing IT security while minimizing user pushback with DoorDash's System Administrator
When it comes to identity security, adding a time-sensitive step on top of a username and password creates a major hurdle for bad actors and significantly reduces the consequences of password reuse.
Even if password fatigue has compromised an employee鈥檚 credentials, the hacker involved would also need to obtain the employee鈥檚 phone or associated MFA token creator at the time they are using the compromised credentials.
Implementing MFA can be an easy and cost-effective way to protect against the repercussions of password fatigue.
3. True Single Sign-On鈩�
With the rise of SaaS web apps, some vendors in the Identity-as-a-Service (IDaaS) space created tools that could bridge a user鈥檚 password stored in an on-prem directory service to the cloud. Dubbed single sign-on (SSO) solutions, these tools soon became some of the most sought-after identity management products.
Although they鈥檙e powerful at connecting identities to web applications, these SSO tools do not propagate passwords to systems, networks, servers, on-prem applications鈥� pretty much any IT resource that isn鈥檛 a web application.
There is, however, a next generation IDaaS solution, available from the cloud, that does just that. As a modern cloud directory service, this solution takes a single set of user credentials and applies it to virtually all of an employee鈥檚 IT resources, regardless of platform, protocol, provider, or location.
This concept of True Single Sign-On (True SSO) is completely changing the way IT admins manage their organizations and actively fighting password fatigue on the front lines. Instead of dozens of passwords, employees simply use one secure identity along with optional MFA for all resources. The cloud directory service then uses a hyper-secure TLS connection with hashing and salting to extend that password and other forms of identity to log in to the IT resource.
Password Fatigue vs. 黑料海角91入口庐
This True SSO cloud directory service is the 黑料海角91入口 Directory Platform. With 黑料海角91入口, IT admins can tightly manage their users and access to their IT resources from a single admin console in the cloud. When it comes to fighting password fatigue, in addition to True SSO, admins can also enable and enforce MFA and conditional access policies with 黑料海角91入口 to tighten up their organization鈥檚 security.
If you鈥檙e interested in seeing what a cloud directory service can do for you, why not and try it yourself? There鈥檚 no credit card required, and every 黑料海角91入口 account includes 10 users and 10 devices for as long as you need until you scale. You鈥檒l also get 10 days of 24×7 Premium in-app chat support.
Fight back against password fatigue in your organization with 黑料海角91入口 Directory-as-a-Service.
