Employees in the financial sector could use more creativity in choosing online passwords, according to an analysis from a large password manager for businesses and individuals.
As a part of its analysis, NordPass listed password selections for 20 industries, including the financial sector, in 31 countries, with nearly half in the United States (other industries included aerospace, retail and real estate, though most of the companies came from the financial, health or IT sectors).
To NordPass CEO Jonas Karklys, the results make it clear all industries should “speed up in transitioning to alternative online authentication solutions.”
“On one hand, it is a paradox that the wealthiest companies on the planet with financial resources to invest in cybersecurity fall into the poor password trap,” he said. “On the other hand, it is only natural because internet users have deep-rooted unhealthy password habits.”
According to NordPass, some financial employees focused on summer when choosing passwords, with “vacation,” “summer” and “sunshine” making the top 20 (other industries had their own unique inclusions, from “dummies” at No. 6 among consumer goods sector employees to “sexy4sho” reaching No. 16 among employees in the real estate field).
Among all companies, 32% of respondents used passwords directly referencing or hinting at their company (including the full company name, email, abbreviation or products). These passwords were “poor and dangerous,” opening employees up to intrusions, Karklys said.
“When breaking into company accounts, hackers try all the password combinations referencing a company because they are aware of how common they are,” he said.
While most of the top 10 passwords are self-explanatory, others resist easy explanation (take No. 3, “aaron431,” for example). A NordPass spokesperson said while the company builds the lists, it couldn’t supply additional information on a password’s origins.
Passwords Will Inevitably Die
The study complements a series of password-related research projects NordPass has delivered throughout the years. In 2021, the company looked into the passwords that Fortune 500 companies use, and, in 2022, it investigated the password habits of top-level business executives. Moreover, NordPass annually presents the “Top 200 most common passwords” study, which broadly covers the password trends of internet users.
“While password trends slightly vary each year across different audiences, the general take is that people continuously fail with their password management, and the world desperately needs to switch to new online authentication solutions such as passkeys,” says Karklys.
Various progressive businesses such as Google, Microsoft, Apple, PayPal, KAYAK and eBay have already adopted passkey technology and are offering their users password-less logins. According to Karklys, in no time at all, other online companies will start following this trend.
Tips to Secure Business Accounts
According to an IBM report, in 2022, stolen or compromised credentials remained the most common cause of a data breach in companies, accounting for 19%. Karklys said that by implementing a few cybersecurity measures, businesses could avoid many cybersecurity incidents.
- Ensure company passwords are strong. They should consist of random combinations of at least 20 upper- and lower-case letters, numbers and special characters.
- Enable multifactor authentication or single sign-on. While the MFA set up on another device, connected with email or SMS codes, guarantees an additional layer of security, single sign-on functionality helps reduce the number of passwords people have to manage.
- Critically evaluate whom to grant account credentials. Access privileges should be removed from people leaving the company and passed on only to those who need certain access.
- Deploy a password manager. With a business solution, companies can safely store all their passwords in one place, share them within the organization, ensure their strength and effectively manage access privileges.
Methodology
The passwords list was compiled in partnership with a third-party company specializing in cybersecurity incident research. Researchers analyzed data that affected the world’s 500 largest companies by their market capitalization. The analyzed data was categorized into 20 different industries. The researchers investigated the top 20 passwords used in each industry.