Individuals and Employers Aren’t Following Password Best Practices

Twenty percent of employers never require employees to change their passwords, a survey finds.

A survey in which 2,500 Americans were asked about their password behaviors and tendencies found a fifth of employers don’t regularly require their employees to change their work program passwords.

In addition, the survey by cybersecurity firm PC Matic revealed that nearly one-quarter of respondents use the same passwords for their home and personal accounts. Another example of a bad practice of mixing home with work is that more than half of respondents have admitted to checking their personal emails on work devices, increasing the likelihood of a malicious infection infiltrating a company’s networks.

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

Bad password practices exist in both personal and work use. Of those who responded that they have at least one email account, just shy of 30% are not sure when they last changed their password or never have at all.

More than 40% of respondents indicated that they remember their passwords by memory and don’t use a password manager or write them down somewhere. PC Matic suggests this could be the reason such a significant percentage of respondents haven’t changed their passwords or don’t know when they last did. In addition, the firm speculates that this finding indicates individuals are likely using the same password for multiple accounts and that their passwords are most likely not meeting complex password standards.

PC Matic’s survey results in 2020 revealed that as individuals age, they are more likely to write their passwords down. Respondents in 2021 confirmed that as well, with 47.11% of Baby Boomers preferring to write their passwords down compared with 16.63% of Millennials.

Nearly 30% of respondents are using a password manager to safeguard their password information. Millennials, however, lead the respondent groups in both remembering their passwords by memory and in the use of password managers. Nearly 50% of Millennial respondents indicated that they remember their passwords by memory, and just over 35% stated that they use a password manager.

Regarding personal Wi-Fi networks, the survey found nearly 60% of users haven’t changed their Wi-Fi passwords since their networks were set up or don’t know how to do so.

PC Matic suggests that passwords should be a combination of uppercase and lowercase letters, numbers and special characters. Users should never reuse passwords on multiple accounts and should create unique passwords and store them in a safe place for remembrance.

For corporate passwords, the firm recommends that businesses issue passwords to their employees. The survey found only 16% of employers issue their employees a password. The overwhelming majority (80%) allow their employees to choose their own passwords, and just 4% of employees have their passwords set by a password generator.

The PC Matic survey report includes top tips for individual users, as well as employers.

Benefit Plan Fiduciaries and Service Providers Anticipating New Litigation Risks

Experts say COVID-19 could open the door to new a new category of ERISA lawsuits.  

Risk and compliance departments are drafting preventative measures to avoid continued Employee Retirement Income Security Act (ERISA) litigation. That’s according to experts at Seyfarth Shaw, Berkshire Hathaway Specialty Insurance and Mazars, who discussed ERISA complaints and compliance during a webinar hosted by the firms.

But there could be new categories of ERISA lawsuits that plan sponsors should be aware of, panelists cautioned.

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

One new sector of litigation involves COVID-19, and, specifically, its effect on cybersecurity, the panel said. As offices moved to remote work in 2020, the risk for cyberhacks heavily increased—as did the possibility that litigation that could follow.

Candace L. Quinn, senior counsel at Seyfarth Shaw, said there has indeed been a related rise in class action complaints. While it is not specified whether participant data is a protected asset under ERISA, the Department of Labor (DOL) has recognized that there are risks to plans with electronic communications.

Quinn advised employers to identify and assess both internal and external cybersecurity risks. She said they should seek expert advice, negotiate cybersecurity protections in service providers’ contracts, monitor service providers who might be cross-marketing participant data and limit the use of participant data for non-plan products and services. “Take careful steps to protect that data,” she said.

According to Kathleen Cahill Slaught, partner at Seyfarth Shaw, employers should be wary of potential COVID-19 litigation that involves financial distress from employees due to job loss, cybersecurity management and data privacy, business interruptions or continuities, and relations within the workforce.

For example, employers could face litigation over mistakes in offering medical coverage for furloughed workers, which could result in a claim alleging a breach of their fiduciary duty of loyalty. Slaught suggested that to avoid this risk, it’s critical for plan sponsors to check in with their plan administrators or trustees. For self-insured medical plans, employers may need to file an amendment. It is also important to review plan documents to determine benefit eligibility when reviewing COBRA [Consolidated Omnibus Budget Reconciliation Act] benefits, she added.

On the topic of COBRA, the panelists said litigation involving the program is increasing as well. According to the panel, a plaintiff may claim that a company or service provider was not using the DOL model notice, therefore causing some employees to not elect COBRA benefits.

Typical problems with COBRA notices include failures for them to: be written in a manner that is understood by the average plan participant; identify the plan administrator, instead having participants speak to a vendor; explain that a legal guardian may elect continuation coverage on behalf of a minor child, or a minor child who may later become a qualified beneficiary; explain the termination date along with the maximum period of coverage and any events that can cause early termination; thoroughly explain the election process; and include an address where payments would be sent.

Panelists also warned employers that plaintiffs in such cases may seek class certification, damages and daily statutory penalties that will add up quickly in a class case.

When asked what the top three considerations for fiduciaries are to avoid litigation, Slaught recommended plan sponsors regularly review plan documentation and committee members.

“When I’m defending these cases, the court is looking for evidence that fiduciaries are paying attention and were looking at these issues,” she said. “Is there proper governance of your plan? Are your committees working efficiently? Have they been meeting regularly and following investment policy statements [IPS]?”

Dolph also suggested that plan sponsors consider working with ERISA counsel when reviewing these terms, so the examination may potentially be privileged. 

Rhonda Prussack, senior vice president and head of fiduciary and employment practices, liability at Berkshire Hathaway Specialty Insurance, advised employers to think through their fiduciary insurance options. She explained that more issues in a plan means it will have to pay more for insurance.

“If you have fee exposures; if you are in the sweet spot for [current litigation trends] of anywhere of upward of $100 million in plan assets; have not done an RFP [request for proposals] in a long time or have recently done one, then you should probably get an amount of insurance that is at least 10% of your plan assets,” she said. If a fiduciary has other questions about insurance, they can also contact their insurance broker, Prussack concluded.

«