The survey was carried out to find out how easy it was to extract peoples work passwords using social engineering techniques with literally just the offer of a chocolate bar for taking part in a survey.  The survey was carried out amongst commuters in London Stations and also at an IT exhibition full of computer professionals just to see how much more security savvy they were compared with the average worker.

The survey found that it took a little more probing and a bit more coercion than the average office worker, but even the IT professional eventually succumbed to the questions of the attractive researcher who still managed to extract their passwords in exchange for a smile and a chocolate bar!

The researchers asked the delegates if they knew what the most common password is and then asked them what their password was.  Only 22% of IT professionals revealed their password at this point compared to 40% of commuters, if at first they refused to give their password the researchers would then ask if it was based on a child, pet, football team, etc, and then suggest potential passwords by guessing the name of their child or team.  By using this technique, a further 42% of IT professionals and 22% of commuters then inadvertently revealed their password.   This then took the total number of people who revealed their password to 64% overall for both groups.   What many of IT professionals failed to realise is that the researchers, who conducted the survey at the IT exhibition, had also read their names and organisation from their delegate badge as well!

The survey found that 20% of organisations no longer use passwords, with 5% using biometric technology and tokens for identity and access management and a further 15% using tokens.

The average number of passwords used at work was 5 per person, with some using as many as 20.  The frequency of changing passwords was 71% monthly, 10% rarely and 20% never as they used biometrics and tokens instead.  Some of the IT professionals said that the real issue was not user passwords but the passwords on servers or buried in applications which were never changed as the consequence of changing them on the overall company IT system was unknown and there was a fear that if they were changed a critical part of the system could crash.  Some other IT experts said that they often come across servers on which the administrator password was left blank.

When asked if they knew any of their colleagues passwords 29% admitted that they did. A person should never need to give their password to someone claiming to be from the IT department but 39% said that they would give their password to someone who called them from the IT department.  They would not be quite so trusting if asked by their boss as only 32% said they would be prepared to give their password if asked.

When asked about confidential information two thirds said that they would look at a file containing everyone's salary details if they were sent it by mistake and 20% said they would pass it on to colleagues.  A third said that they would keep it confidential, with many of them also saying that their IT systems tracked everything they looked at and if they passed this type of information on to anyone it would mean instant dismissal.  When asked if they would take any contacts or competitive information with them when they left their jobs, 58% said that they would.  One senior sales manager said I left my job last week and took my whole pipeline with me.

Just under half of people used the same password they used for their corporate access for all their personal web accounts such as online banking, retailing, and email.  When asked if they felt safe using online banking half said that they did but only a fifth said they felt safe using online retailing but this figure rose to 52% if the retail site was a well know reputable one.