LastPass Enterprise for a small company

Today I set up LastPass for my staff. I’m test­ing the Enterprise version. It doesn’t cost much, but it will save a lot of nerves and time. Besides, it’s very handy in day-to-day work!

I’ll briefly describe what it can do, and later I’ll prob­a­bly write a detailed post on set­ting it up.

So LastPass lets you:

1. Keep a shared com­pany pass­word data­base in pro­tected form.
2. Log in quickly to every site with a saved password.
3. Hand pass­words to col­leagues or sub­or­di­nates conveniently.
4. Create shared pass­word folders. For exam­ple, “Purchasing”.
5. Grant access to shared fold­ers by user role, for exam­ple “Buyer”. You may well have sev­eral buyers, and each gets access simply by being assigned the role.
6. Generate strong pass­words for new ser­vices auto­mat­i­cally, with no need to remem­ber them.
7. Store form-filling data securely, includ­ing pay­ment forms with credit card details (care­ful with that one!).
8. Set com­pany poli­cies on pass­word strength and on access from dif­fer­ent IPs and mobile devices.

The nicest thing about the com­pany ver­sion, for me, is this. When the pass­word to some ser­vice changes, I (the admin) simply change it in the shared folder. That’s it. Nobody needs to be told, sent or made to remem­ber anything. No panic the next morn­ing: “Aaah, Stas, I can’t get into XXX!”

Another advantage. Employees don’t even have to see the pass­word you give them to use. LastPass can fill in forms with the right pass­words itself. The employee only has to pick an account, if LastPass holds sev­eral logins for the same site.

About SAML

Today some time went into test­ing SAML. It’s a tech­nol­ogy that lets Google Apps users get into their accounts with­out the login form at all. It works like this. A user tries to open your com­pany email page for the first time. The address should be some­thing like https://mail.google.com/a/yourcompany.com.

If that person is already logged into LastPass through the Chrome exten­sion, LastPass fills in the email login for them and sends them straight to the inbox. If LastPass can’t find such a user in Google Apps, it asks for the user’s first and last name and cre­ates an account for them. In Google Apps! Cool, isn’t it?

SAML doesn’t suit me yet, since each of our employ­ees uses sev­eral mailboxes. And with SAML you can’t log into some­one else’s Google Apps account.

First settings

For my admin account I turned on two-factor authen­ti­ca­tion with the Google Authenticator app. It’s safer.

For the whole com­pany I turned on a policy that blocks access from mobile devices until the admin, that is me, allows it.

I haven’t worked through all the poli­cies yet. There’s a lot to dig into. For exam­ple, super admin rights let the super admin recover other employ­ees’ master passwords. In the per­sonal ver­sion, if you forget your master pass­word, that’s it: you can’t get your data back.

Keeping personal and company accounts apart

LastPass han­dles work­ing with two accounts at once very well. I haven’t tested it yet, but they promise con­ve­nient use of your per­sonal data inside the com­pany account. The admin, of course, has no access to the pass­words in the per­sonal account. When you’re fired, you simply leave with your per­sonal passwords.

Summary: the service seems worth the money

LastPass can help com­pa­nies bring order to how employ­ees’ pass­words are stored, raise secu­rity, and save time on cre­at­ing, hand­ing over and chang­ing passwords. Passwords on sticky notes around the office are just not the done thing.