--- title: "Survey of IT Pros: Password Procedures Still Are A Cyber Security Fail" description: "Survey of 2600 IT Pros: \"Password Procedures Still Are A Cyber Security Fail\"" image: https://blog.techboston.com/hubfs/Imported_Blog_Media/Password_Policy_Pass_Phrase-2.png --- ### Search engine Use this form to find things you need on this site Search × [![We're better together.](https://blog.techboston.com/hubfs/Tech_Networks_of_Boston_June2018/Images/Logo_without_motto-copy-web.png)](https://techboston.com) - [About TNB](https://techboston.com/about-tnb/) - [Overview](https://techboston.com/about-tnb/) - [Annual Report](https://techboston.com/wp-content/uploads/2023/03/2022-Benefit-Report.pdf) - [Mission](https://techboston.com/about-tnb/mission/) - [Partnerships and Affiliations](https://techboston.com/about-tnb/partnerships/) - [Certifications & Awards](https://techboston.com/about-tnb/certifications-awards/) - [Blog](https://techboston.com/about-tnb/blog/) - [Free Resources](https://techboston.com/about-tnb/resources/) - [Job Opportunities](https://techboston.com/about-tnb/careers/) - [Services](https://techboston.com/our-services/services-overview/) - [Overview](https://techboston.com/our-services/services-overview/) - [Integrated Services](https://techboston.com/our-services/integrated/) - [Managed Services](https://techboston.com/our-services/managed-services-2/) - [Project Services](https://techboston.com/our-services/project-services/) - [Case Studies](https://techboston.com/case-studies/) - [Using IT to Increase Productivity and Reduce Costs](https://techboston.com/case-studies/increase-productivity/) - [Updating Technology for Growing Needs](https://techboston.com/case-studies/updating-technology/) - [Shifting to Remote Work in the Midst of a Crisis](https://techboston.com/case-studies/remote-work/) - [Protecting Your Organization in the Wake of Cybercrime](https://techboston.com/case-studies/cybercrime/) - [Integrating Technology for Mission Driven Success](https://techboston.com/case-studies/integrated-technology-success/) - [Events](https://techboston.com/events/) - [Upcoming Events](https://techboston.com/events/) - [Past Roundtable Events](https://techboston.com/past-roundtable-events/) - [TNB’s Dialogue Series on Nonprofit Data and Evaluation](https://techboston.com/about-tnb/blog/best-practices-data-evaluation/) - [Contact Us](https://techboston.com/about-tnb/contact-us/) - [Home](https://techboston.com/) - [About Us](https://techboston.com/about-tnb/) - [2022 Annual Report](https://techboston.com/wp-content/uploads/2023/03/2022-Benefit-Report.pdf) - [Blog](https://techboston.com/about-tnb/blog/) - [Certifications & Awards](https://techboston.com/about-tnb/certifications-awards/) - [Case Studies](https://techboston.com/about-tnb/case-studies/) - [Job Opportunities](https://techboston.com/about-tnb/careers/) - [Mission](https://techboston.com/about-tnb/mission/) - [Partnerships and Affiliations](https://techboston.com/about-tnb/partnerships/) - [Events](https://techboston.com/events/) - [Services](https://techboston.com/our-services/) - [Contact Us](https://techboston.com/about-tnb/contact-us/) # Survey of IT Pros: Password Procedures Still Are A Cyber Security Fail [Home](https://techboston.com) / Survey of IT Pros: Password Procedures Still Are A Cyber Security Fail Return to Previous Page [![image-1](https://blog.techboston.com/hubfs/Imported_Blog_Media/Password_Policy_Pass_Phrase-2.png)](https://blog.techboston.com/hubfs/Imported_Blog_Media/Password_Policy_Pass_Phrase-2.png) [View large](https://blog.techboston.com/hubfs/Imported_Blog_Media/Password_Policy_Pass_Phrase-2.png) [Tech News](https://blog.techboston.com/tag/tech-news), [Tech Tips](https://blog.techboston.com/tag/tech-tips) ### Survey of IT Pros: Password Procedures Still Are A Cyber Security Fail Cyberheist News says:   After the NIST [passwords bombshell](https://blog.knowbe4.com/this-password-bombshell-will-make-you-scratch-your-head), KnowBe4 surveyed 2,600 IT professionals to find out how they were managing passwords The answers show that IT Pros are generally receptive to the proposed pass phrase concept suggested by NIST. [NIST Special Publication 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html), “Digital Identity Guidelines,” states: “Many attacks associated with the use of passwords *are not affected by password complexity and length*. Keystroke logging, phishing, and social engineering attacks are equally effective on lengthy, complex passwords as simple ones. This means that password complexity has failed in practice." Verizon's latest Data Breach Report showed that 81% of hacking-related breaches used either stolen and/or weak passwords, supporting the NIST conclusion. KnowBe4’s survey showed that 44% of respondents overall, (large organizations with 1,000+ employees and small to mid-size businesses), think a roughly 25-character pass phrase could work versus 35% who don’t believe it to be a viable option for their organization. Here are the survey results [(PDF)](https://www.knowbe4.com/hubfs/Passwords_Survey_Results.pdf?t=1502825071040) The highlights from the survey are: - Nearly 97% of large organizations have an enforced password policy compared to almost 88% in small to mid-size organizations. - A majority (63%) of organizations do not allow password re-use, however this does not prevent employees from using the same password on multiple sites. - Almost half (49%) of large organizations believe their current password policy is insufficient, while 48% of small to mid-size organizations believe their password policy is good enough. - Enterprise-size organizations (1,000+ users) prefer multi-factor authentication (MFA) with only 38 % stating they do --- ![Password_Policy_Pass_Phrase.png](https://blog.techboston.com/hs-fs/hubfs/Imported_Blog_Media/Password_Policy_Pass_Phrase-2.png?width=513&name=Password_Policy_Pass_Phrase-2.png) Bill Burr, former NIST (National Institute of Standards and Technology (NIST) engineer who wrote the password complexity requirement said the 2003 standards had failed in practice. With multiple devices, accounts and websites, the average user has somewhere around 27discrete passwords to remember. “Passwords are a known weakness in corporate security and have come under more intense scrutiny recently. Most organizations have password enforcement in place, but most aren’t taking it seriously enough by not enforcing policies beyond the normal number and letter character minimum and not requiring multi-factor authentication,” said Stu Sjouwerman, CEO of KnowBe4. “It is well-known that employees are the weakest link in security and that includes password usage. IT can’t expect employees to put password policies in place on their own. It’s an effort that IT must lead.” KnowBe4 encourages companies to test their password enforcement with a free tool to find out how exposed their users are with its Weak Password Test and Tech Networks of Boston can help get you started. --- #### How weak are your user’s passwords? Are they... P@ssw0rd? Verizon's recent Data Breach Report showed that 81% of hacking-related breaches used either stolen and/or weak passwords. Employees are the weakest link in your network security, using weak passwords and falling for phishing and social engineering attacks. **KnowBe4’s complimentary Weak Password Test (WPT) checks your Active Directory for several different types of weak password related threats.** WPT gives you a quick look at the effectiveness of your password policies and any fails so that you can take action. WPT tests against 10 types of weak password related threats for example; Weak, Duplicate, Empty, Never Expires, plus 6 more. *Here's how Weak Password Test works:* - Reports on the accounts that are affected - Tests against 10 types of weak password related threats - Does not show/report on the actual passwords of accounts - Just download the install and run it - Results in a few minutes! **This will take you 5 minutes and may give you some insights you never expected!** You can contact us, or download the weak password test here: Tech Networks of Boston is now partnering with KnowBe4 to provide you the security awareness training you need for your organization. [Contact us](mailto:sales@techboston.com) to learn more! Share Post - - - - - [mailto:?body=https://blog.techboston.com/survey-2600-pros-password-procedures-still-cyber-security-fail](mailto:?body=https://blog.techboston.com/survey-2600-pros-password-procedures-still-cyber-security-fail) [Previous](https://blog.techboston.com/bringing-b-game-mass-companies-arent-focused-profit-alone) [Bringing our B game: Some MA companies aren’t focused on profit alone](https://blog.techboston.com/bringing-b-game-mass-companies-arent-focused-profit-alone) [Next](https://blog.techboston.com/events-charlottesville-prompt-tech-companies-crack-hate-speech) [![](https://blog.techboston.com/hubfs/15xp-godaddy-master768.jpg) Charlottesville prompt companies to crack down on hate speech](https://blog.techboston.com/events-charlottesville-prompt-tech-companies-crack-hate-speech) #### RELATED POSTS Tech Tips [![Training Your Staff on New Tools](https://blog.techboston.com/hs-fs/hubfs/training%20your%20staff.png?width=387&name=training%20your%20staff.png)](https://blog.techboston.com/training-your-staff-on-new-tools) #### Training Your Staff on New Tools July 28, 2022 at 10:26 AM by Veronica Moreno-Nestojko … Tech Tips , IT security [![The Benefits of 24/7 Monitoring and Reporting](https://blog.techboston.com/hs-fs/hubfs/24_7%20monitoring.png?width=387&name=24_7%20monitoring.png)](https://blog.techboston.com/the-benefits-of-24/7-monitoring-and-reporting) #### The Benefits of 24/7 Monitoring and Reporting February 18, 2021 at 04:23 PM by Veronica Moreno-Nestojko … Tech Tips , Uncategorized #### 4 ways your small business can embrace innovation June 12, 2019 at 11:20 AM by Ashley Fontes … Tech Tips , Security awareness [![How Your Nonprofit Can Manage Data Breaches and Minimize Risk](https://blog.techboston.com/hs-fs/hubfs/CyberSecurity.png?width=387&name=CyberSecurity.png)](https://blog.techboston.com/how-your-nonprofit-can-manage-data-breaches-and-minimize-risk) #### How Your Nonprofit Can Manage Data Breaches and Minimize Risk May 17, 2019 at 06:37 PM by Veronica Moreno-Nestojko … ### Leave a Reply [![updatedblogad](https://blog.techboston.com/hs-fs/hubfs/updatedblogad.png?width=312&name=updatedblogad.png)](https://techboston.com/about-tnb/contact-us/)                    ### Contact Us 1 Wadleigh Place South Boston, MA 02127 Phone: 617.269.0299 Fax: 888.527.9333 ### GET UPDATES ### Resources [Server Failure and Recovery](https://techboston.com/resources/server-failure/) [Plan a Successful Email Migration to the Cloud](https://techboston.com/resources/email-migration/) [How to Align Your Staff on Technology Use and Policies](https://techboston.com/resources/technology-policies/) [Data Loss and Recovery: A Guide](https://techboston.com/resources/data-loss-recovery/) [Assess Your IT Needs: Is an MSP Right For You?](https://techboston.com/resources/assess-it/) [IT Audits and Assessments: What Are They Good For?](https://techboston.com/resources/it-audits-assessments/) [The Right Time to Change Your MSP](https://techboston.com/resources/change-msp/) [Privacy Policy](https://techboston.com/privacy-policy/) © 2021 Tech Networks of Boston