The password burden is well known to all. Password manager vendors love to publish figures to drive their sales. There is no doubt however, that estimates that the average business user has 100 or more passwords is not unrealistic. And that the burden is growing.

Wherever your organisation is with hybrid working practices and outsourced services, the risks from password fatigue are real and aren’t going away anytime soon.

What is password fatigue?
Password fatigue is the overwhelming feeling of exhaustion people experience because they need to manage a large number of passwords in order to carry out their daily duties.  It’s not just about volume either, the inconsistent password demands of third-party services are infuriating, the password game at Neal.fun captures this in a delightfully absurd way.

The consequences of password fatigue

Time wasted on password resets:
Users spend a considerable amount of time resetting forgotten passwords or managing logins across all their accounts. A LastPass study found that employees spend an average of 36 minutes a month just resetting passwords.

Weak password habits:
Password fatigue can lead users to adopt bad password habits. This might be to reuse passwords across accounts, use easily guessable options, or even write them down.

Phishing susceptibility:
Frustrated users can be more susceptible to phishing attacks. They may be less likely to scrutinise emails or login prompts carefully.

Poor user experience:
Constantly struggling with passwords can be a source of frustration and negatively impact employee morale. This can lead to decreased job satisfaction and potentially higher turnover rates.

Steps you can take to reduce the risk of password fatigue

There are several steps you can take to help reduce password fatigue and aid your overall security posture. Here are some suggestions:

Introduce strong yet simple password policies:
Create clear guidelines for password complexity, length, and rotation. Consider using passphrases instead of passwords. Read our Which is Better: Passphrase or Password? article on why this alternative can benefit everyone.

Enforce password complexity:
Use tools that enforce password complexity and prevent the use of weak or common passwords.

Use password managers:
User-friendly password management tools are relatively common today, helping employees securely store and manage their login credentials.

Implement multi-factor authentication (MFA):
MFA adds that extra layer of security beyond merely passwords. Widely adopted, it can play a key part in reducing reliance on complex password combinations.

Implement risk-based authentication:
Risk-based authentication works by adapting security measures based on login context, reducing the need for complex passwords for low-risk activities.

Implement single sign-on:
Another popular option, SSO reduces the number of passwords employees need to manage.

Simplify your password reset processes:
Make it easy for your users to reset their passwords if they forget them. Consider allowing your users to reset their passwords themselves through a secure portal.

Train users on password security & phishing:
Regularly remind your users on best practices for creating strong passwords and how to spot and avoid phishing attacks.