One sweet smile and your security is breached

Most workers would gladly surrender their passwords for a bar a of chocolate and a  smile from a pretty girl.

In a survey of 300 commuters and IT professionals by Infosecurity Europe, 64 per cent gave up their passwords after being given the chocolate by the young woman for agreeing to take part in a "survey" at London Underground stations and an IT exhibition.

The idea was to see how hard it would be to get them to reveal their passwords. Not very, it seems.

Researchers asked people what they thought the most common password was followed by what their own was. Amazingly, 40 per cent of commuters and 22 per cent of IT professionals told them.

Those that at first refused were then probed with questions about what their password related to (pet, child, football team) with researchers trying to guess what it was. Using this technique, a further 22 per cent of commuters and 42 per cent of IT professionals inadvertently let slip their password.

The survey also found that the average number of passwords used at work was 5 per person, with some using as many as 20. Almost 30 per cent of respondents admitted that they knew some of their colleagues’ passwords, while over one-third admitted that they would give out their password over the phone to someone who said they were with the IT department.

“This survey shows that even those in responsible IT positions in large organisations are not as aware as they should be about information security,” commented Sam Jeffers, event manager for Infosecurity Europe 2007.

“What is most surprising is that even when the IT professionals became slightly wary about revealing their passwords, they were put at their ease by a smile and a bit of smooth talk. It just goes to show that we still have a long way to go in educating people about security policies and procedures as the person trying to steal data from a company is just as likely to be an attractive young woman acting as a honey trap as a hacker using technology to find a way into a corporate network.”