How Reusing Passwords Is Hurting Your Business

Michael Greene

Security hygiene is an increasingly important factor in today’s heightened threat environment when companies are vetting technology providers, MSPs and others in the channel. These groups are investing significant sums of money to strengthen security to protect their data and their clients, yet there is a critical area that is often overlooked: password reuse and the sharing of passwords between personal and work accounts.

The average person knows better than to reuse passwords across multiple work and personal related sites, but the human desire for convenience and efficiency will trump this knowledge every time. For example, 91% of respondents in a LogMeIn survey claim to understand the risks of reusing passwords across multiple accounts, but 59% admitted to doing it anyway. What’s more, 62% of employees are reusing the same password for both work and personal accounts.

There is a staggering amount of breach data on the internet and Dark Web and with attacks occurring on a continuous basis, this treasure trove for hackers is only growing. I recently spoke with a company that discovered that 4% of its uncompromised credentials become compromised within one month and this happened month over month. All a cybercriminal needs to do is obtain an exposed credential from one breach and use those same credentials to access other sites and systems. With the rampant practice of password reuse, it won’t be long before the hacker is able to access sensitive accounts and information.

For channel partners, this practice represents a serious security vulnerability. MSPs have emerged as a top target for hackers, with the U.S. Department of Homeland Security’s Computer Emergency Readiness Team (US-CERT), issuing an alert warning companies of advanced persistent threat activity. In addition to the typical headaches associated with data breaches — financial repercussions, brand impact, loss of sensitive data — MSPs and other groups in the channel face the added pressure of fallout from the client and vendor community. For many, this pressure will be too much to withstand — one study found that 60% of small businesses fold within six months of experiencing a breach.

What Can Channel Companies Do?

Organizations have historically addressed compromised passwords by implementing mandatory password resets every 42 to 90 days following the recommendations of traditional guidelines. However, times have changed as both the National Institute of Standards and Technology (NIST) and Microsoft have recently come out against password expiration for a number of reasons:

• Security: Employees typically choose a simple password or a pattern that can be easily guessed when forced to change passwords frequently.
• Costs: Mandatory password resets can drive up help desk costs, with Forrester estimating it costs $70 of help desk labor for a single password reset.
• Productivity: In addition to the financial element, password resets divert both IT and end-user resources away from more strategic initiatives — companies lose upwards of $420 in productivity annually per employee due to password challenges. This is a painful factor for many MSPs.

With awareness growing of these and other issues associated with expiring passwords, organizations must now focus on securing employee accounts from the start. Many companies in the channel have high employee turnover, and it’s important to be conscious of poor password practices that might follow your new hire from their prior position. Researchers from Virginia Tech University found that more than 70% of users employed a compromised password for other accounts up to a year after it was initially leaked, with 40% reusing passwords which were leaked over three years ago. This underscores that companies must expect poor password hygiene from their users and revise password policies accordingly.

NIST recommends that companies now verify …