HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Survey Reveals Password Best Practices are Not Being Folllowed

A recent survey conducted by researchers at Skynet Softtech has revealed most adults are guilty of poor password practices that are placing their accounts and sensitive data at risk.

The survey was conducted on 2,200 adults in the United Kingdom who were asked about cybersecurity practices related to password creation and password management.

The best practice for password creation is to create a complex, unique password for each account. Those passwords should be a random combination of upper- and lower-case letters, numbers, and special characters. The problem with that approach is it also makes passwords very difficult to remember, which is why password manager solutions have become so popular. With a password manager, a user only needs to remember one password to access the password manager, which stores al other passwords in a secure vault.

The survey revealed password reuse across multiple accounts is rife and passwords are easy to guess with a little knowledge about the individual. Further, once passwords are set, they are rarely changed.

Two thirds of respondents used an average of just 3 passwords for all their online accounts. Each person had an average of 50 online accounts that were protected with a password. There was bad news for employers, as 48% of respondents said they used the same passwords for their business and personal accounts.

When passwords are chosen, the best practice is not to use dictionary words or names that are easy to guess. 20% of people said they used their street name in their password, 15% used a pet’s name, and 14% used a special date such as an anniversary or birthday. That information can easily be found out from social media networks or with a little social engineering.

On average people change their passwords every 7 years, with only 5% of people saying they updated passwords for key accounts regularly to keep them secure.

The main reason for not following password best practices and setting complex passwords and changing them regularly was users were worried they would forget their passwords (51%) or that they struggled choose a new password that was sufficiently secure (29%).

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.