Average Employee Manages Nearly 200 Passwords

Employees use an average of 191 passwords to enter 154 times in a given month, racking up an estimated 36 minutes of password data entry during that time, according to a report released today.

The Password Exposé report, based on aggregated and anonymized data from over 30,000 LastPass customers, found that other industry reports often underestimate the number of credentials used and put the figure closer to an average of 27 passwords per employee.

In addition to enterprise apps, employees often use dozens of other apps while at work, such as advertising and analytics platform apps as well as demonstration apps, the report notes.

Meanwhile, companies and employees do not get full relief by using single sign-on (SSO) technology.

Although a number of enterprise apps have SSO capabilities, more than 50% of the most popular websites and services, such as Box, MailChimp, and LinkedIn, do not support SSO out of the box, the report states.

As a result, companies are left to put a business password manager in place to ensure all of those websites and services are "captured" and managed by IT policies, says Rachael Stockton, director of product strategy at LastPass.

Password vaults with multifactor authentication are enabled in 26.5% of the companies included in the report, a level that lacks broad enough adoption to offset the problems that enterprises face with passwords, according to the report.

"Multifactor authentication isn't supported widely enough across Web services, and isn't adopted frequently enough by businesses, to offset the risks that passwords pose," Stockton says. "While the business community is moving in the right direction, change is happening too slowly. Until universal coverage with multifactor authentication (or even behavioral or contextual authentication) is available, companies need to invest in strengthening the password-protected services in use across the entire organization."

Another recent study found that while corporate America's use of passwords remains prevalent, multifactor authentication is showing some signs of growth in the enterprise. Javelin Strategy & Research's 2017 State of Authentication Report found 100% of enterprises continue to use passwords, despite industry calls to ditch them all together or at least bolster security through a combination of passwords and other measures, such as biometrics and public key infrastructure.

Password vaults also grow exponentially, the study found. The average employee starts with 20 credentials in their password vault and within three months that number doubles, according to the report.

LastPass, in a report from last year, found that 91% of users were aware of the risks of reusing passwords, yet 61% continued with the practice.

Business and Personal Password Use Intermingled
Roughly half of the top 36 popular websites that employees access for work are consumer solutions, such as Dropbox, Google, and Evernote, the report states. But the owners of these accounts are likely the employees, even though sensitive work-related data is likely stored on these accounts.

"The line between 'business' and 'personal' apps is a blurry one. People are often using personal accounts in the workplace, and may even be doing work or sharing work data in those personal accounts," says Stockton.

The report also points to a recent Ovum study that found 23% of workers will use their social media credentials to log into business systems and applications, as well.

"It was very surprising to learn that businesses were allowing access to their data through sites protected only by personal passwords that they have no control over," Stockton adds.

In citing the problems with this practice, Stockton says the first one is control. When an organization allows an employee to log in via Facebook, then it is leaving all the password policy control, such as two-factor authentication, password rotation, and number of characters to the end user and raises the risk that a weak password is protecting access to critical business data, she says.

The second risk, Stockton observes, is that social media credentials are often reused and not very secure.

"If one social media website has a security incident, there's increased risk that attackers will find re-used credentials to access corporate accounts," she says. "You are basically outsourcing the password security for your company to another website."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.