Ensuring strong security with password managers

In today’s technology focused world, passwords have become an overwhelming everyday occurrence. The number of passwords users and Australian businesses need to store and remember has exploded exponentially. With the vast number of passwords needed day to day, users’ resort to using passwords that are either weak and easy to remember, a variation of a current password or a combination of the two.

Using a secure and reputable password manager can help alleviate these password issues. Password managers allow staff to store their day-to-day business passwords, but also to store and manage team passwords. Many business password managers will allow business to manage and create teams and folders that allow them to store shared passwords. This allows you to segment your business and use least privileged access to ensure staff members only have access to the password they need. This access can then be revoked if required, for example if staff leave.

One of the main benefits to using a password manager is creating and storing strong and unique passwords for every service that you and your business access. Good password managers have a built-in password generators. This allows you to create a strong random password, that includes a range of letters, numbers and special characters. Password managers will also allow you to customise the length and parameters of the passwords it generates. These passwords are then saved in the password manager, meaning you only need to remember your one master password.

Most businesses, even small business will have a group of shared passwords for services and accounts that only have one login. A lot of the time these passwords are stored in a shared word or excel document on a company drive; Other times they may be stored on sticky notes or a notebook in a desk draw. This poses a security risk; it only takes the book being taken or the document being copied for someone to take all your company passwords. With a password manager, an Administrator or Service provider like FordhamIT can create teams and groups of passwords. They can then assign and revoke user access to these groups of passwords.

The passwords saved by password managers are stored in an encrypted vault. This is protected by your master password, it is important to ensure your master password is complex to ensure the security of the vault. You should also ensure that you are using multi factor authentication. This involves using a second form of identity, such as a hardware key or authenticator app. This further hardens the security of your password manager, and in turn your business security.

Business and Enterprise password managers can also implement advanced logging and history. They can track incidents such as a password being deleted, changed, or moved in the shared password vault. They should also keep a log of who logs into the vault and from what device or browser. A password history will also be kept for each password; If the old password is needed or changed by accident, it can be recovered using the password history.

While improving security is a top priority for businesses, staff won’t use solutions that are cumbersome or create difficulty in their workflow. Reputable password managers will offer a range of apps and access. This usually includes apps for Android, IOS, Windows, MAC, and any modern web browser such as Edge, Chrome or Firefox. This allows staff to use the browser extension and retrieve passwords while they are browsing websites, this dramatically reduces the day to day friction of using a password manager. Browser extensions will also only offer passwords based on the website URL; if staff somehow make it to a malicious website, the password manager will not offer the password they have saved as the website URL doesn’t match. This can further help reduce password phishing.

Enterprise password managers can go beyond just storing passwords. Now many also have the option for dark web monitoring and scanning, this includes known breaches to ensure your passwords were not found in a breach or on the dark web. They can also allow administrators to review the strength and uniqueness of the passwords across staff and the organisation. This ensures staff follow password policy requirements.

Utilising password managers, businesses can increase their security posture by promoting the use of strong unique passwords and providing a secure method of storing those passwords. With centralised management and logging, this further enhances visibility and accountability for the business. If your business could benefit from a password management solution, reach out to us and we would be happy to assist you with this and provide a holistic overview of your IT and security.