--- title: 'Are Bad Passwords the Employee’s Fault?' url: 'https://blog.datum-consulting.com/blog/bad-passwords-employees-fault' markdown: 'https://blog.datum-consulting.com/blog/bad-passwords-employees-fault.md' date: '2019-10-02' description: 'Every time another website is hacked, or another company suffers from a data breaches, the same advice crops up in the media and in corporate blogs. Over and over again experts offer lists of all the things companies should do to protect themselves, especially when it comes to employees and their p…' taxonomy: category: - blog tag: - cybersecurity - 'data security' - 'security solutions' - passwords - 'password manager' - hacker - 'cyber attack' - malware - 'data breach' month: - October archives_month: - oct_2019 archives_year: - '2019' --- # Are Bad Passwords the Employee’s Fault? [ Home ](https://blog.datum-consulting.com/) Are Bad Passwords the Employee’s Fault? ## [Are Bad Passwords the Employee’s Fault?](https://blog.datum-consulting.com/blog/bad-passwords-employees-fault) 2nd Oct 2019 [cybersecurity](https://blog.datum-consulting.com/tag:cybersecurity#body-wrapper) [data security](https://blog.datum-consulting.com/tag:data%20security#body-wrapper) [security solutions](https://blog.datum-consulting.com/tag:security%20solutions#body-wrapper) [passwords](https://blog.datum-consulting.com/tag:passwords#body-wrapper) [password manager](https://blog.datum-consulting.com/tag:password%20manager#body-wrapper) [hacker](https://blog.datum-consulting.com/tag:hacker#body-wrapper) [cyber attack](https://blog.datum-consulting.com/tag:cyber%20attack#body-wrapper) [malware](https://blog.datum-consulting.com/tag:malware#body-wrapper) [data breach](https://blog.datum-consulting.com/tag:data%20breach#body-wrapper) Every time another website is hacked, or another company suffers from a [data breaches](hackers-malware-data-breaches), the same advice crops up in the media and in corporate blogs. Over and over again experts offer lists of all the things companies should do to protect themselves, especially when it comes to employees and their passwords. After a data breach, we inevitably see advice on how employees should create [better passwords](what-makes-a-secure-password), with lists that look like this: - Don’t use the same password everywhere. - Don’t share password with others. - Don’t use names, pet’s names, birthdays, and other personal information. - Use letters, numbers, and symbols. - Have a different password for every account. - Store passwords in a safe place away from the computer. - Change passwords often (every 30, 60, 90 days). - Make passwords 12, 14, 16 or more characters long. **But the standard advice for fixing passwords is impossible to follow.** This is the standard advice, but it’s ineffective because it’s impossible for an employee to follow it without a tool to do the work for them. And if a company doesn’t have a system for measuring compliance, it’s inevitable that employees will fail to follow the standard password security advice. Companies are relying on their employees to make their own passwords and to follow best password practices on their own. As long as companies continue with this model, we will continue to see them suffer from massive breaches that severely endanger the personal identities of their customers and employees, and even put the company’s own survival at risk. **Companies are adding to the burden of passwords rather than relieving it.** Statistically, people create very weak passwords. Employees will only do the bare minimum required to create a password. It’s not their fault, it’s the result of an overtaxed memory and an effort to make passwords as usable as possible. This means employees will create passwords that are memorable, shorter, with easy patterns, and likely to be reused between work accounts and personal accounts. They’ll store account information around their desk or the office, they’ll use unsecured Word or Excel documents to store logins, and they’ll leave default passwords like “admin” and “password” in place on critical systems. In short, employees will never have good password hygiene if a company doesn’t make it easier for them by providing better tools. **Employees need the right password management tools.** By recognizing that the majority of people cannot cope with the requirements of creating passwords that are strong enough, companies can start recognizing that the password problem is a toolset problem, not the employee’s problem. Think of it this way. Would a company require an employee to build their own lock to secure their office door? Would the company ask an employee to build their own antivirus software to protect their computer from [malware](hackers-malware-data-breaches)? Would the company ask the employee to create their own identity card to securely access the building? A password is just as essential in protecting valuable information. Because passwords are so commonplace, though, and password fatigue has crept up slowly over the years, many companies have overlooked how critical they are to their security. As a result, they’ve failed to get the right toolset in place to protect their organization, employees, and customers. The dialog changes when we view passwords from the same angle as we would a lock on a door or antivirus software. Only then can companies recognize that employees need a strong toolkit to build and track passwords for them. A [password management system](lock-down-your-passwords) allows an organization to gain control of employee password behavior at all levels. Improved password practices both at work and at home help employees keep all of their accounts and computers better protected overall. **Start helping employees solve the password problem.** So let’s agree to stop blaming employees for their bad password practices, and recognize that the best solution comes with a better toolset. That toolset is a [password management system](lock-down-your-passwords) that helps employees effectively create, manage, share and use passwords. When employees have the right toolset, they can comply with company policy and help in their security efforts. And by enlisting every employee in the strategy to keep a company’s data safe, companies can better mitigate risk at all levels. If you want to learn more about how you can be proactive in solving the password problem for your company, contact Datum Consulting to learn how we help organizations manage employee access and protect critical assets. [ Previous Post](https://blog.datum-consulting.com/blog/hackers-malware-data-breaches) [Next Post ](https://blog.datum-consulting.com/blog/avoiding-phishing-scams) #### Related Posts - 100 [The Most Hacked Passwords Around the World](https://blog.datum-consulting.com/blog/most-hacked-passwords "The Most Hacked Passwords Around the World") - 100 [Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins](https://blog.datum-consulting.com/blog/passwordless-sign-ins "Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins") - 100 [How Hackers Get Your Passwords and How To Defend Yourself](https://blog.datum-consulting.com/blog/hackers-get-passwords "How Hackers Get Your Passwords and How To Defend Yourself") - 100 [How to Keep Your Company Safe from Russian Hacks](https://blog.datum-consulting.com/blog/russian-hacks-safety "How to Keep Your Company Safe from Russian Hacks") - 100 [Protecting Your Business From Data Disasters](https://blog.datum-consulting.com/blog/protecting-data-disasters "Protecting Your Business From Data Disasters") [JOIN OUR NEWSLETTER](https://zc.vg/sf/bawK1) [PAY INVOICE ONLINE](https://datum.connectboosterportal.com/authentication/login) [![](https://blog.datum-consulting.com/modules/sidebar/Yubico.png)](https://www.pntra.com/t/SkNJTk5MT09DSEZMTExNQ0dPR0tNSw) #### Follow Us [](https://twitter.com/datumconsulting "Twitter")[](https://www.linkedin.com/company/datum-consulting/ "LinkedIn") "); #### Popular Tags #### Archives - [ 3 May 2022 ](https://blog.datum-consulting.com/archives_month:may_2022) - [ 3 March 2022 ](https://blog.datum-consulting.com/archives_month:mar_2022) - [ 3 February 2022 ](https://blog.datum-consulting.com/archives_month:feb_2022) - [ 2 January 2022 ](https://blog.datum-consulting.com/archives_month:jan_2022) - [ 1 December 2021 ](https://blog.datum-consulting.com/archives_month:dec_2021) - [ 2 November 2021 ](https://blog.datum-consulting.com/archives_month:nov_2021) - [ 2 October 2021 ](https://blog.datum-consulting.com/archives_month:oct_2021) - [ 1 September 2021 ](https://blog.datum-consulting.com/archives_month:sep_2021) - [ 3 August 2021 ](https://blog.datum-consulting.com/archives_month:aug_2021) - [ 2 July 2021 ](https://blog.datum-consulting.com/archives_month:jul_2021) - [ 4 June 2021 ](https://blog.datum-consulting.com/archives_month:jun_2021) - [ 2 May 2021 ](https://blog.datum-consulting.com/archives_month:may_2021) --- ## Navigation - Parent: [Home](https://blog.datum-consulting.com/index.md) - Previous: [Avoiding Phishing Scams](https://blog.datum-consulting.com/blog/avoiding-phishing-scams.md) - Next: [What’s the Difference Between Hackers, Malware, and Data Breaches?](https://blog.datum-consulting.com/blog/hackers-malware-data-breaches.md)