Security is hard. Quit blaming millennials.

A new article from TheThreatReport argues that millennials aged 18 to 25 are a growing threat to the information security of businesses. According to the author, 90% of adults in the 18 to 25 age range break basic security practices. “It’s these millennials that take a wrong approach to security,” the article boldly states. The security practices being broken include password reuse, installing software without permission, and not informing IT if they suspect a compromise. The data source for this article is a survey performed by SailPoint across 1,000 different organizations, and 1,600 different employees were interviewed.

Is it really fair to say that millennials are the rising threat to businesses?

We have known for a while now that humans are the weakest link to any organization. According to the article, this is the second time the survey has been performed. The first time, in 2014, the survey concluded that 56% of millennials reused passwords across websites and applications. The second time around, almost 5 years later, the survey concluded that a massive 75% of millennials reused passwords.

We must immediately jump and attack the millennials because that will get us views, right?

No. This is getting ridiculous.

Password reuse is a problem that spans multiple generations. It is something that people of all ages struggle with, and it is a symptom of the ever increasing reliance on technology. Sure, we can blame the younger generation for being born (not by their choice) into a time that has forced them to memorize too many passwords to handle. But we have known for a while now that passwords are not secure, because humans will create short cuts to make them easy to remember and easily guessable. Yes, password reuse is dangerous; a compromise in one location can result in a compromise of every location. If security is not done properly.

Your Business OPSec Sucks

The original article does not provide numbers or quote the survey directly, but the “problems with millennials” that they are pointing out sound like poor business operations to me. Yeah, password reuse is bad, but this is a known problem. This is something that will never go away entirely. Why are these businesses not providing their users with password managers and mult-factor authentication? When the first survey was performed 5 years ago, there were obviously fewer millennials in the work force. The second time around, the same 18 year olds that were surveyed are now 23 years old and still taking up the same portion of results.

Businesses cannot blame their employees for being human.

Businesses must adapt technology to fit human behavior; You cannot force human behavior to fit technology.

As far as those damn millennials installing things without permission, WHY ARE THEY ABLE TO?! IT must operate in a way that accommodates the users needs and encourages the users be collaborative partners, but users still should not be enabled to do more than they are authorized to! Train users to report breaches of any type, personal or business related. Educate your users as to why they need to care about security. Don’t sit there and further this fad of attacking the younger generation for our failure to educate them. It is almost as annoying as the corporate world forcing humans to fit technology.