A few years ago during an inspection to evaluate how safely data was being kept at a large financial institution in Charlotte, North Carolina, a group of risk consultants found that more than a third of employees with access to sensitive information had chosen "password" as their password. The consultants alerted the firm's managers.
Two years later the consultants returned. Financial executives proudly showed off how security had been tightened since the previous visit. As instructed, most employees had personalized their passwords. Unfortunately, a quarter of those employees had posted the new password on their monitors.
Such carelessness might have been dismissed with a chuckle not long ago, but with confidential information at financial institutions increasingly under attack, it has become a chilling illustration of just how ineffective bank data system security can be.
TowerGroup, a Needham, Massachusettsbased consulting firm, estimates that online security attacks on U.S. businesses have doubled...
