In a recent study by the UK’s National Cyber Security Centre (NCSC), they found that 123456 is the most used password on accounts that have been breached. They analyzed public databases of breached accounts to discover what words, phrases or number combinations were most used. From their research, they discovered that there’s a wider gap in cyber knowledge than they had anticipated.
The rest of the lazily-set passwords
While 123456 took the top spot with over 23 million uses, the second most popular string was only slightly less demanding to crack—123456789. Others making the top five (5) included 1111111 and qwerty.
The most commonly used name was, oddly enough, Ashley. Michael, Daniel, Charlie (gulp) and Jessica closely followed. And, while they don’t state that the databases analyzed were primarily from UK accounts, it can probably be assumed considering English Premier soccer (ah, I mean football) teams were password-inspiring Liverpool and Chelsea. Defending champion Manchester City didn’t fare well—or maybe they did, depending how you look at it.
It was an American rock band that topped this less-than-desirable chart—Blink-182. It’s assumed they were big hitters due to passwords that required a combination of letters, numbers and at least one (1) symbol. The B-52s were a couple decades too late.
The takeaway seems pretty intuitive—don’t use easily guessed words or numbers. And if you’re dead-set on using something you’ll remember, at least string together several words. Liverpoolcharlie123456, while not great, maybe, is a start.
Security habits
The NCSC’s study also delved into the psychology of users’ fears and habits. In an odd twist, almost fifty percent (50%) of respondents stated that they expected to lose money to online fraud at some point, and only fifteen percent (15%) were confident they could keep themselves safe online. It begs the question: Why, if they’re sure they’re going to lose money and they have no confidence in their security, don’t they use better passwords?
Security expert Troy Hunt, who maintains a comprehensive database of hacked accounts, said picking a good password was the single greatest control users have against attacks.
With the volume of excellent password management tools available, users have a spate of options to address this issue. It’s not a security panacea, but will greatly help keep your choice of passwords from being analyzed off a hacked account database.
Contact these pro’s if you’re looking for answers to your organization’s network security questions
To find out how to shore up your organization’s security posture, contact GDT’s tenured and talented engineers and security analysts at SOC@GDT.com. From their Security and Network Operations Centers, they manage, monitor and protect the networks of organizations of all sizes, including those for some of the most notable enterprises, service providers, healthcare organizations and government agencies in the world. They’d love to hear from you.
