Companies rely more and more on cloud services: the office is getting slim. Now it’s critical how and where you and your employees keep passwords. To steal important information, nobody needs to come to your office. It’s enough to break into one employee’s email or social network profile. And from there: the contacts, the passwords, the lot…
Your employees keep their passwords any old how.
You can protect your company from being hacked if, among other things, you take a sensible approach to storing passwords.
Here are a few simple measures:
A new problem arises. Secure passwords are hard to remember, and you can’t write them down. So what do you do with them? Many people make a spreadsheet in Google Sheets and give access to everyone who needs it. It works, but it isn’t good either. It’s especially “fun” to search the spreadsheet for a password, find it, and only then discover it’s out of date. And you won’t get far separating access by employee role.
The sensible way out is a password manager.
A password manager is a program that encrypts your passwords and keeps them in a safe place. Two in one: secure passwords that are convenient to use. All you have to remember is one password, the one to the manager itself.
There are many password managers. They’re usually fairly hard to understand and set up (do you have to hire a “programmer”?), and they get criticized all the time. Big companies have long known how to solve these problems. They have their own security specialists and specialized solutions. The owner of a small or medium business, though, can easily get lost in the technical details. I spent a little time and figured the subject out. Here’s what I learned.
These programs come for personal and for company use. There are local versions (all the data is stored on your computer or a local drive) and cloud ones. Local ones are said to be safer. These are, for example, KeePass and RoboForm. With them you have to carry the password file around everywhere or put it on a server somewhere. The latter sharply reduces the point of a local manager, since your server is most likely not protected well enough. Kinda defeats the purpose. So, cloud ones.
And naturally we’re interested in managers that work for a company. What that means: we need to control which passwords are available to which employees; set how strong passwords must be; share them safely between employees in the same department, and so on.
A company password manager has plenty of advantages:
Of the cloud services with company features, I know two: LastPass and Dashlane. Want details? See Lifehacker’s comparison (in a Russian translation on Siliconrus) or just search for it. If you set aside the indie products* of small companies, only LastPass and Dashlane remain. And given that Dashlane costs twice as much, it’s clear why I chose LastPass.
*Siliconrus once promoted a service called Passwork, but there are fewer reasons to trust it than LastPass. Though it costs a little less.
Earlier I wrote a short review of what LastPass Enterprise can do. Since then I’ve switched to a paid account, set it up for all employees, and turned on some policies and two-factor authentication.
I found no particular drawbacks apart from the dated interface design. It’s the oldest and largest manager. Of course, that makes it a tasty target for hackers. They were even breached in June, but nothing much was stolen and nobody was hurt. Careless journalists blew it up into news, though, and now everyone “knows” that “LastPass isn’t safe” and keeps writing passwords on sticky notes.
Business owners and managers should think about a digital security policy for their companies. Storing and passing passwords around carelessly is a serious security threat. I recommend rolling out a company password manager. It’s convenient, safe and saves time. I chose LastPass for myself, though there are alternatives. Figuring it all out isn’t hard, but a business owner does need to spend some time on it.