People are still the weakest link in computer and internet security, study finds
October 13, 2009Two decades ago, studies showed that computer users were violating best practices for setting up hack-proof passwords, and not much has changed since then. What's clear, say researchers at the University of Wisconsin-Madison and IT University in Copenhagen, is that until human factors/ergonomics methods are applied to the problem, it isn't likely to go away. They will present the results of their CIS study at the upcoming HFES 53rd Annual Meeting at the Grand Hyatt San Antonio in San Antonio, Texas on October 19.
The best software and hardware in the world can do only so much to safeguard data and protect security; it's up to users to follow best practices in creating passwords to authenticate their computer when logging in. For instance, the password should contain at least eight characters; people should not use the same password every time for every site; and unlike some of the 34,000 MySpace login IDs examined in 2006, their password should not be set as "password." But the more complicated — and therefore the more secure — the password, the harder it is to remember. In addition, the best practice recommendation to use multiple, difficult-to-remember passwords for different password-protected accounts causes interference ("Which password do I use for which site?"), not to mention frustration.
Researchers Peter Hoonakker, Nis Bornoe, and Pascale Carayon developed a questionnaire based on input from network administrators and CIS experts to examine people's password behavior. They obtained responses from 836 employees of an organization that handles very sensitive private information. Respondents categorized themselves as novice, average, advanced, or expert users. Although some reported following best practices (for example, had 4 to 9 different passwords, used more complex passwords when needing special protection, changed their passwords 7 times per year, and logged off when not at the computer), 94% said they violate at least one (called a nonmalicious CIS deviation). "In reality," Hoonakker et al. said, "the results are probably worse, because respondents do not like to admit that they deviate from the rules." Perhaps not surprisingly, the less experienced the user, the more likely he or she was to violate computer authentication best practices.
But even close adherence to such best practices is compromised by human memory and information-processing limitations. A password that includes a picture may be easier to remember and presents one potential solution. Biometrics (fingerprint or retinal scans) is another alternative, or a combination of authentication methods (a smart card plus a PIN), but even these more expensive security measures are not "bullet-proof." As evidence of this, a 2009 study of a two-factor authentication approach to e-banking found that most participants preferred the least secure device because they perceived it as more user-friendly.
"A better balance has to be found between the limitations of human beings and the desire for increased security," the researchers concluded. "More research on how perceptions of usability, security, and convenience are related is needed."
More information: "Password Authentication from a Human Factors Perspective: Results of a Survey Among End-Users," (http://www.hfes.org/web/Newsroom/HFES09-Hoonaker-CIS.pdf) published in the Proceedings of the Human Factors and Ergonomics Society 53rd Annual Meeting (p. 459).
Source: Human Factors and Ergonomics Society
-
Tired of Passwords? Replace Them With Your Fingerprint
Sep 14, 2004 |
not rated yet |
0
-
Networking: The end of 'shoulder surfing?'
Feb 20, 2006 |
not rated yet |
0
-
So many passwords, so little memory
Apr 15, 2009 |
not rated yet |
0
-
RIT professor recommends tougher computer security measures to beat hackers
Dec 03, 2008 |
not rated yet |
0
-
RSA launches secure real-estate solution
Oct 26, 2005 |
not rated yet |
0
-
Engineers build first sub-10-nm carbon nanotube transistor
Feb 01, 2012 |
4.9 / 5 (31) |
30
-
Something old, something new: Evolution and the structural divergence of duplicate genes
Jan 31, 2012 |
4.6 / 5 (7) |
1
-
The hidden nanoworld of ice crystals: Revealing the dynamic behavior of quasi-liquid layers
Jan 30, 2012 |
5 / 5 (3) |
1
-
Stock market network reveals investor clustering
Jan 27, 2012 |
3.9 / 5 (23) |
8
-
Of microchemistry and molecules: Electronic microfluidic device synthesizes biocompatible probes
Jan 26, 2012 |
5 / 5 (1) |
0
-
Calling function with no input argument
14 hours ago
-
Force free body diagram problem on gym equipment
15 hours ago
-
Empirical data regarding shower heads and water
23 hours ago
-
feed hold button on CNC lathe
Feb 09, 2012
-
RFAC in Fortran
Feb 09, 2012
-
dynamics 2/32
Feb 08, 2012
- More from Physics Forums - General Engineering
More news stories
Google users warned of threat to smartphone wallets
Users of Google smartphone wallets were being warned on Friday that there is a way to crack pass codes intended to thwart thieves from going on illicit shopping sprees.
7 hours ago |
5 / 5 (2) |
0
Anonymous knocks CIA website offline (Update)
The website of the Central Intelligence Agency was inaccessible on Friday after the hacker group Anonymous claimed to have knocked it offline.
8 hours ago |
5 / 5 (9) |
13
New error-correcting codes guarantee the fastest possible rate of data transmission
Error-correcting codes are one of the triumphs of the digital age. Theyre a way of encoding information so that it can be transmitted across a communication channel such as an optical fiber o ...
Technology / Computer Sciences
17 hours ago |
4.9 / 5 (8) |
6
|
New power source discovered
(PhysOrg.com) -- Researchers at the Massachusetts Institute of Technology (MIT) and RMIT University have made a breakthrough in energy storage and power generation.
Technology / Energy & Green Tech
16 hours ago |
4.8 / 5 (26) |
8
|
Small modular reactor design could be a 'SUPERSTAR'
(PhysOrg.com) -- Though most of today's nuclear reactors are cooled by water, we've long known that there are alternatives; in fact, the world's first nuclear-powered electricity in 1951 came from a reactor ...
Technology / Energy & Green Tech
16 hours ago |
4.3 / 5 (12) |
22
|
Humans may have helped the decline of African rainforests 3000 years ago
(PhysOrg.com) -- Large areas of rainforests in Central Africa mysteriously disappeared over three thousand years ago, to be replaced by savannas. The prevailing theory has been that the cause was a change ...
Complex wiring of the nervous system may rely on a just a handful of genes and proteins
Researchers at the Salk Institute have discovered a startling feature of early brain development that helps to explain how complex neuron wiring patterns are programmed using just a handful of critical genes. ...
The power of estrogen -- male snakes attract other males
A new study has shown that boosting the estrogen levels of male garter snakes causes them to secrete the same pheromones that females use to attract suitors, and turned the males into just about the sexiest ...
Putting the squeeze on planets outside our solar system
(PhysOrg.com) -- Using high-powered lasers, scientists at Lawrence Livermore National Laboratory and collaborators discovered that molten magnesium silicate undergoes a phase change in the liquid state, abruptly ...
Could Venus be shifting gear?
(PhysOrg.com) -- ESAs Venus Express spacecraft has discovered that our cloud-covered neighbour spins a little slower than previously measured. Peering through the dense atmosphere in the infrared, the ...
Fool's gold may prove an unlikely alternative to overexploited catalytic materials
Catalytic materials, which lower the energy barriers for chemical reactions, are used in everything from the commercial production of chemicals to catalytic converters in car engines. However, with current catalytic materials ...