April 16, 2008, 10:44 AM — A new survey by Infosecurity
Europe finds that women are four times more likely than men to sell their passwords
to total strangers in exchange for chocolate.
The survey of 576 office workers found that 45% of women and 10% of men would
give away passwords to strangers masquerading as market researches with the
lure of a chocolate bar as an incentive for completing the survey. The survey,
conducted outside Liverpool Street Station in the City of London, was actually
part of a social engineering exercise to raise awareness about information security.
“Our researchers also asked for workers' names and telephone numbers so
that they could be entered into a draw to go to Paris. With this incentive,
60% of men and 62% of women gave us their contact information,” said Claire
Sellick, Event Director, Infosecurity Europe.
As she revealed her details to our researchers one woman said, “even though
I have just been to Paris for the weekend I would love to go again.”
“That promise of a trip could cost you dear," Sellick said. "As
once a criminal has your date of birth, name and phone number they are well
on the way to carrying out more sophisticated social engineering attacks on
you, such as pretending to be from your bank or phone company and extracting
more valuable information that can be used in ID theft or fraud.”
Workers were also queried about their use of passwords at work, half said that
they knew their colleagues passwords and when asked if they would give their
passwords to someone who phoned and said they were from the IT department, 58%
said they would. Researchers also asked workers if they thought other people
in their company knew their CEO's password. 35% them thought that someone else
did with Personal Assistants and IT staff being the most likely suspects.
Most people used only one (31%), two (31%) or three (16%) passwords at work,
but a few poor souls had to use as many as 32! It was also found that 43% of
people rarely or never change their passwords which is very poor security practice.
The survey was carried out as part of the run up to Information Security Awareness
week which starts on the 21st April.
