News

Study: Some employees willing to sell company passwords

In some cases, employees say they would be willing to sell their corporate passwords for as little as $150.

March 25, 2016

A global survey of 1,000 employees at large organizations has revealed a widespread level of employee indifference towards protecting sensitive corporate data, including personal information of customers. In fact, the 7th Annual Market Pulse Survey by Sailpoint, a provider of identity and access management services, found that 1 in 7 employees would sell their company passwords, some for as little as $150.

Additional findings from the survey:

• 1 in 5 employees routinely share login information for corporate applications with other members of their team, which increases the potential that the passwords they sell might not even be their own;
• more than half (56 percent) of respondents admitted to some level of daily password reuse for the corporate applications they access; and
• up to 14 percent of employees use the same password for all applications.

"[U]sing the same password across personal and work applications exposes the company," said Kevin Cunningham, president and founder of SailPoint. "Just think of the major breaches that occurred in 2014 requiring users to change their passwords on social media. If those were the same passwords being used to access mission-critical applications, it's very easy for hacking organizations to take advantage and get into more valuable areas."

Sailpoint suggests using an identity and access management solution with capabilities that include:

• an intuitive, self-service password reset portal to increase user productivity through convenient password reset and change options;
• off-network and desktop support to reduce operational costs and password-related calls to the help desk;
• centralized access policies and controls that strengthen security through consistent enforcement of strong password policies;
• password intercept and synch that conveniently and automatically synchronizes password changes across all on-premises and cloud-based applications; and
• an integrated single sign-on that reduces the need to rely on application-specific passwords and simplifies access to users' apps.