How password-less security benefits helpdesks

IT departments and helpdesk teams are desperately overworked and understaffed, and unfortunately, they continue to get inundated with even more tasks. Helpdesk teams are there for everything from huge system outages to simple password resets, and everything in between.

As the list of helpdesk tasks continues to grow, IT teams can improve efficiency and effectiveness by making changes to eliminate some of the most mundane and time-consuming tasks. Chief among these are password resets.

The hidden costs of password resets

Ask any helpdesk team lead about the most frequent requests from employees, and password resets will rank highest. Forrester Research determined that large organizations spend up to $1 million per year on staffing and infrastructure to handle password resets alone.

Password resets may seem like an easy problem to solve, but the volume of requests makes them an extremely time-consuming task. According to META Group, helpdesks receive on average a staggering 21 calls per user, per year. Gartner estimates that 40% of all helpdesk calls are related to passwords, such as resetting employees’ forgotten passwords.

For many enterprises, there’s typically a process for resetting passwords that isn’t as easy as a two-minute fix. Employees will have to contact the helpdesk – which could be internal or external – whose team generates a support ticket, resets the password and notifies the employee.

Adding complexity, many organizations use dozens of productivity platforms and web applications. So, when an employee submits a ticket for one password reset, this quickly turns into numerous backend resets – a compounded burden for the helpdesk. During the waiting period, the employee may be unable to complete their core work responsibilities. In the case of financial or healthcare institutions, waiting 30 minutes to reset a password may also diminish overall customer experience and satisfaction. In today’s enterprises, being able to log in quickly and seamlessly ensures these employees are properly serving customers.

A common security practice among enterprises is to mandate the use of longer passwords. While these do make accounts somewhat safer, they’re also impossible for employees to remember. The longer a password is, the more resets helpdesks have to deal with.

This aside, costs haven’t even been factored in yet. A higher number of helpdesk tickets equals more wasted money – both from paying the helpdesk employee to handle it and from using the necessary backend infrastructure to reset it. With Forrester Research estimating that one password reset can cost $70.00, aggregate costs for these common incidents seems unreasonable.

Forgotten user passwords are a resource sink, password resets are onerous, and almost half of helpdesk requests are squandered on password issues alone. Employees and helpdesk teams alike are understandably frustrated. So, what can be done to address this pain point and lighten the burden for employee and helpdesk technician alike?

Eliminate passwords entirely

If you can relieve IT from password reset calls, not only can they be more productive in other areas, but enterprises can also reduce costs. The biggest issue is forgotten passwords – so why not remove them? With password-less security — here, defined as the end state of the user having no password — helpdesks never have to reset a password or user credential again.

In fact, Google Cloud predicted that 2019 will mark the start of a broader password-less era due to an increase in mainstream adoption. But what exactly does password-less authentication entail?

Password-less security removes centralized passwords from the enterprise entirely — not simply backburning it from the login experience. It enables users to authenticate to a service on their mobile device using their thumbprints, facial recognition, and other common authenticators people already use for convenience. The user verifies their identity locally, to an encrypted variant of their biometric isolated deep within the device’s most trusted area, and she or he communicates with the service using tokens.

Password-less security eliminates the “shared secret” means of the user and service possessing the same set of credentials, and it safeguards both parties from the mega breaches, credential reuse, and phishing that are the #1 cause of online fraud.

Aside from the protections it grants the enterprise and user, password-less security can save enterprises millions in service costs by reducing password resets, helpdesk requests, and call center inquiries. It allows the helpdesk and its employees become more efficient and content. Password resets aside – these teams will also recover 40% of their time back to focus on more sophisticated, harder to detect, and more pressing security problems.

Today passwords are the #1 cause of major security breaches. Password reuse is on the rise, fueled by over 130 million malicious login attempts that happen each day, per Shape Security‘s 2018 Credential Spill Report. Demand for password-less security inside the enterprise grew significantly throughout 2018 alone, with Verizon’s Data Breach report estimating that over 80% of breaches are caused by weak or stolen passwords. There’s no better time to eliminate the time-consuming and costly task of password resets – and passwords altogether – so that IT departments and helpdesks are granted the freedom they want to solve more interesting, more pressing matters.