Password security: Password behavior analysis at a small university

Abstract

No matter how sophisticated and advanced an organization's security system is, it remains vulnerable due to the human factor. In this paper, we conducted a survey to analyze the patterns used by the faculty, staff, and students when generating passwords at a small sized university. We found that users are not as aware of security requirements and practices as they think. Moreover, the vast majority of users' passwords are breakable within days or shorter. Interestingly, we found that using numbers and uppercase letters is common among users. However, numbers are mostly used at the end of the passwords and uppercase letters are mostly used at the beginning of passwords. The existence of such trends makes it easier for attackers to generate more effective dictionaries. Based on the analysis in this paper, we make recommendations to IT personnel and the general public to harden the security of their passwords.