A new IBM global report examining consumer behaviors finds an average of 15 new online accounts were created and 82% are reusing the same credentials some of the time.
Screenshot of IBM’s report on Pandemic Security Side Effects. Image: IBM
Not surprisingly, consumers shifted further into digital interactions during COVID-19 and are likely to continue a digital-first mindset post-pandemic, a new IBM report finds.
Based on a survey of more than 20,000 people around the world, the study on the security “side effects” of the pandemic also found that growing preferences for digital convenience are leading to lax security habits among users. With billions of new accounts created and users reporting widespread password reuse, the report stresses that these habits will provide ammunition for cybercriminals for years to come.
Among the key findings:
-
Digital boom will outlast pandemic: People created 15 new online accounts on average during the pandemic, and 44% do not plan to delete these new accounts once society returns to pre-pandemic norms.
-
Account overload leads to password fatigue: 82% admitted to reusing their online credentials across accounts – meaning most of the new accounts created likely relied on reused email and password combinations, exposed via data breaches over the past decade.
-
Convenience outweighs security and privacy: More than half (51%) of millennials said they would rather place an order digitally vs. call or go to a physical location in person – even if there were concerns about the app/website security or privacy.
-
Paving the way for digital ID? The concept of “vaccine passports” exposed consumers to a real-world use case for digital credentials; 65% said they are now familiar with the concept of digital credentials, and 75% would be likely to use it if they became commonly accepted.
With users more likely to overlook security in favor of the convenience of digital ordering, companies will have to assume the burden of security and provide these services to avoid fraud, the IBM report said. Bad personal security habits may also carry over to the workplace – in fact, compromised user credentials represented one of the top root sources of cyberattacks in 2020, according to IBM X-Force threat data.
As consumers lean further into digital interactions, these behaviors also have the potential to spur the adoption of emerging technologies in a variety of settings – from telehealth to digital identity, according to the report.
“The pandemic led to a surge in new online accounts, but society’s growing preference for digital convenience may come at a cost to security and data privacy,” said Charles Henderson, global managing partner and head of IBM Security X-Force, in a statement.
“Organizations must now consider the effects of this digital dependence on their security risk profile,” Henderson said. “With passwords becoming less and less reliable, one way that organizations can adapt, beyond multi-factor authentication, is shifting to a zero-trust approach – applying advanced AI and analytics throughout the process to spot potential threats, rather than assuming a user is trusted after authentication.”
Consumers report high expectations for ease of access
The survey shed light on a variety of consumer behaviors impacting the cybersecurity landscape today and moving forward. As individuals increasingly embrace digital interactions in more aspects of their lives, the survey found that many also have high expectations for ease of access and use.
Attention spans have also grown more limited. Most adults (59%) expect to spend less than 5 minutes setting up a new digital account, according to the survey. Other findings:
-
Three strikes, you’re out: Globally, respondents would attempt three to four logins before resetting their password. These resets not only cost companies money, but they can also pose security threats if used in combination with an already compromised email account.
-
Committed to memory: 44% of respondents store online account information in their memory (most common method) while 32% write this information on paper.
-
Multifactor authentication: While password reuse is a growing problem, adding an additional factor of verification for higher-risk transactions can help reduce the risk of account compromise. About two-thirds of global respondents had used multifactor authentication within the past few weeks of being surveyed.
How organizations can adapt to the shifting consumer security landscape
Businesses that have grown more reliant on digital engagement with consumers as a result of the pandemic should consider the impact this has on their cybersecurity risk profiles, the IBM report said. In light of shifting consumer behaviors and preferences around digital convenience, IBM Security recommends that organizations consider the following:
-
Adopt a zero-trust approach: Given increasing risks, companies should consider evolving to a zero-trust security approach, which operates under the assumption that an authenticated identity or the network itself may already be compromised, and therefore continuously validates the conditions for connection between users, data and resources to determine authorization and need. This approach requires companies to unify their security data and approach, with the goal of wrapping security context around every user, every device and every interaction.
-
Modernizing consumer IAM: For companies that want to continue utilizing digital channels for consumer engagement, providing a seamless authentication process is important. Investing in a modernized consumer identity and access management (CIAM) strategy can help companies increase digital engagement. This aims to provide a frictionless user experience across digital platforms and uses behavioral analytics to help decrease the risk of fraudulent account use.
-
Data protection and privacy: Having more digital users means that companies will also have more sensitive consumer data to protect. With data breaches costing companies $3.86 million on average among those studied, organizations must put strong data security controls in place to protect against unauthorized access. These range from monitoring data to detect suspicious activity to encrypting sensitive data wherever it travels. Companies should also implement the right privacy policies on-premises and in the cloud to help maintain consumer trust.
-
Put security to the test: With usage and reliance on digital platforms changing rapidly, companies should consider dedicated testing to verify that the security strategies and technologies they’ve relied on previously still hold up in this new landscape. Re-evaluating the effectiveness of incident response plans and testing applications for security vulnerabilities are both important components of this process.
By Esther Shein