You would probably be surprised, and now you can find out easily.

It's widely known that passwords are a royal pain in the Kardashian. What's less well known is that managing those pesky things is also a considerable hidden drain on the corporate pocketbook. Do you have any idea how much your organization spends on managing passwords? You can find out in just couple of minutes using the free SSO ROI calculator found at www.botzandassociates.com. And if you're like the majority of people who have used it already, you'll be surprised by just how much you actually spend on password management!

I created the SSO ROI calculator several years ago as a way to compare the benefits between various approaches to solving the password-management issue. As a group, these approaches are typically referred to as "Single Sign-On" (SSO) solutions; however, SSO is really a solution to the password management problem and not a "problem" to be solved.

The calculator is not a marketing tool for any particular solution. It represents an entirely independent assessment based on your particular input. The results are as valid as the input data you provide. It doesn't rely on any behind-the-scenes assumptions that might benefit one solution over another.

Most importantly, this calculator quantifies—in pure business terms—the cost of password management and your organization's estimated ROI for any remediation solution you may consider. In my experience, it's possible for many companies to find a solution that pays for itself in less than a year and then contributes directly to the bottom line after that. That's about as close to immediate gratification for top management as IT can get.

Even if you have no interest in SSO, you can use the tool just to calculate your organization's current cost of managing passwords. Just fill in the assumptions on the first page, look at the calculated cost results on the second page, skip the third page, and ignore the solution cost and ROI results on the fourth page.

The calculator is easy to use. For calculating your current password management costs, you just need to fill in your answers to about a dozen questions related to your end users, administrators, and help desk personnel. (See Figure 1). There are questions about the number of people in each of these roles. There are questions about the amount of time people in these roles spend on password-related tasks (e.g., making changes, debugging problems, etc.). There are also a couple of questions related to the average burden rate for people in these roles. "Burden rate" is an accounting term. It includes not only salary, but a variety of other costs, such as benefits, work space, phone, etc. For better accuracy of results, you might want to get input from a manager or the accounting department regarding burden rates. But if you're just interested in a ballpark figure, you can fill in your best guess -- after all, you can always fill in different numbers later.

Figure 1: Fill out the form.

Once you've filled in the assumptions on the first page, click the tab for the second page. There you will find information about how much it costs your organization to manage passwords. Figure 2 shows the Organizational Costs and Assumptions page.

Figure 2: See what password management costs your company.

You need only pay attention to the top half of the page. It contains the yearly cost calculations for creating and deleting user IDs; password management costs; the portion of that cost related to end users, administrators, and the help desk; and the percentage of the total user ID and password management costs attributable only to password management.

The bottom half of the page contains costs over a specified period of time in years. These costs are calculated from the previous data multiplied by the time period. These values are used for the ROI calculation.

There are a couple of tips and tricks for getting more accurate results with the calculator. The most important one has to do with the average time it takes average users to change their passwords. My experience is that many administrators underestimate the time the average user spends on "password change day." In addition, I suggest that, whatever number you come up with, you add a little bit of padding to cover the amount of time spent by users who have problems changing their passwords or logging in at a later time.

If you're interested in the methodology that drove the creation of the SSO ROI calculator, go to the http://www.botzandassociates.com home page and view the "Evaluating SSO ROI" video. If you would like someone to help you use the calculator or analyze the results, just go to the "Contact Us" page and fill in your name, email and/or phone number, and what kind of help you would like.

In as little as a minute or two, the SSO ROI calculator will show you how much your organization currently spends managing passwords. This may be just a curiosity for you. On the other hand, your management team might also be interested in these costs as a way to reduce overhead and free up staff for more productive work. Whatever your reason, give the calculator a try and see what you find out!

Finally, we would love to hear from you about your password management costs and whether those numbers surprised you in any way. You can give us your feedback on the "Contact Us" page. Just give us your name, and provide the information about the number of users and your costs along with a short description of your reaction. If we get enough results back, we'll summarize them and pass that information along.

Patrick Botz, an internationally known information security expert, is the President and CTO of Botz & Associates, a firm specializing in information security services for IBM i, AIX, UNIX, and Linux environments. 

With decades of experience in key system security positions, Patrick's expertise includes security strategy; security policy enforcement; password management and single sign-on; industry and government compliance; and biometrics.

As Lead Security Architect at IBM and founder of the IBM Lab Services security consulting practice, Patrick worked with IBM customers worldwide and achieved intimate knowledge of system security capabilities and pitfalls on a broad spectrum of platforms, with special emphasis on IBM i (formerly AS/400), AIX, Linux and Unix operating systems. He architected the SSO solution for OS/400 and i5/OS, and he holds several security-oriented patents. 

Early in his tenure at IBM, Patrick lead the AIX workstation tools team for CAD/CAM systems in Rochester, MN. Previous to IBM, he worked for Control Data Corporation with responsibility for CDC's Basic compiler, and for ETA Systems, Inc., a wholly owned supercomputer manufacturing subsidiary of CDC, where he was the team leader for the distributed, Unix-based Electronic Computer-Aided Design (ECAD) tools.

Patrick is the author of numerous trade press articles and a co-author of the book Expert's Guide to OS/400 and i5/OS Security.  In addition, he is a worldwide speaker on various platform-specific and general security topics.