Before we get started, please tell us a little about yourself:

Are your IT privileged administrators (users with escalated rights) using static passwords to authenticate to mission-critical applications-such as your firewall, VPN, web server or key applications?

Never. Privileged administrators in our organization are required to use stronger authentication methods. Sometimes. Yes. Our privileged administrators use only static passwords.

DID YOU KNOW? Attackers often will compromise the passwords of lower-privileged users in order to get to the higher-privileged administrator’s account. With this level of access achieved, the attackers can change firewall rules, change access rules, or erase logs that may indicate their presence to cover their tracks as they do significant damage to your organization.

How often do you require static passwords to be changed for your critical applications?

Every 30 Days

Every 60 Days

Every 90 Days

Never

DID YOU KNOW? Two out of three [attacks] focus on credentials at some point in the attack. Trying to get valid credentials is part of many styles of attacks and patterns, to go in with an authenticated credential opens a lot more avenues. You don't have to compromise every machine. You just log in*.

* Source: Verizon, 2014 Data Breach Investigations Report

Are static passwords used in your organization for remote access, such as access to your VPN?

Never

Rarely

Sometimes

All the Time

DID YOU KNOW? Users often use the same passwords for their work applications as they do for their personal, social, and financial sites. Keeping the same password for every login can mean that a compromised user password from one of these non-work sites can lead to an attack on your organization.

Are static passwords used for remote access to your web portals?

Never

Rarely

Sometimes

All the Time

DID YOU KNOW? Web portals are usually the easiest, quickest pathway for an attacker to compromise your organization. Web portals are open to the Internet so anybody can get to the login screen. In addition, cross-site scripting (XSS) and other vulnerabilities inherent to web applications are well-known to hackers, and can represent increased security risk.

How often do you require your end users to take user security awareness training?

Quarterly

Every 6 Months

Annually

Never

DID YOU KNOW? Security starts with your users. End-user security awareness training can reduce the number of successful phishing attacks on your organization by 37%.

Do you allow users to save their password in their browser for your web-based applications?

No

Yes

Don’t Know

DID YOU KNOW? An attacker that has compromised your user's device can utilize the saved or cached passwords in the browser to gain unauthorized access to your organization's systems and information.

How often are your password policies audited, reviewed, or changed?

Quarterly

Every 6 Months

Annually

Never

Don't Know

DID YOU KNOW? Many organizations forget the importance of a periodic comprehensive review of their access management policies. They realize - often too late - that effective access policies could have prevented or lessoned the impact of a breach.

Please provide a little more information while we generate your report.

Here's how you stack up against your peers: