Password Security in Organizations: User Attitudes and Behaviors Regarding Password Strength

Abstract

Organizations and, to larger extent governments, have in recent years become more reliant than ever on the consistent operation of their information systems (ISs), which have become critical to their success and efficacy. Even though the growing dependence on ISs has created a pressing need for gathering information and easing its accessibility, security vulnerabilities in the systems have unfortunately spawned opportunities for hackers to compromise the system’s integrity and validity. This has put information systems confidentiality at high risk. As this paper shows, user authentication mechanisms, particularly passwords, determine confidentiality, which is an essential aspect of IS security. Passwords have been and are still a common method of securing ISs. A problem arises when users need to memorize and manage passwords that meet requirements, namely that users are more likely to use a single password across multiple accounts. User selection of passwords for use in ISs creates an impasse for the user. Furthermore, the systems progressive reliance on passwords for user authentication points to the necessity of investigating password creation policies in organizations. In spite of organizations recommendations on password choice to users, the majority do not choose to protect their passwords or even require choosing strong passwords in effect making hackers work easier. This study uses a survey questionnaire to evaluate user-generated password characteristics and present findings that prove user negligence with regards to password choice. Additionally, a literature review on password vulnerabilities in organizations is presented.