--- title: "Why your company needs a password manager" author: "Stan Voo" url: https://www.99rabbits.com/blog/why-your-company-needs-a-password-manager published: 2015-08-30 summary: "What a password manager is, why a small company needs one once it lives in cloud services, and why I chose LastPass over Dashlane and the local options." --- # Why your company needs a password manager Companies rely more and more on cloud services: [the office is getting slim](https://www.99rabbits.com/blog/the-slim-office). Now it's critical how and where you and your employees keep passwords. To steal important information, nobody needs to come to your office. It's enough to break into one employee's email or social network profile. And from there: the contacts, the passwords, the lot… > Your employees keep their passwords any old how. You can protect your company from being hacked if, among other things, you take a sensible approach to storing passwords. Here are a few simple measures: - Forbid writing passwords on scraps of paper or in notebooks, pinning them up somewhere visible in the office, and sending them by email or messenger. - Teach employees to make strong passwords instead of "1234567890" and "aadmin". - Forbid using the same password for many services. - Change passwords when an employee leaves. - Change the passwords to critical databases regularly. A new problem arises. Secure passwords are hard to remember, and you can't write them down. So what do you do with them? Many people make a spreadsheet in Google Sheets and give access to everyone who needs it. It works, but it isn't good either. It's especially "fun" to search the spreadsheet for a password, find it, and only then discover it's out of date. And you won't get far separating access by employee role. The sensible way out is a password manager. > A password manager is a program that encrypts your passwords and keeps them in a safe place. Two in one: secure passwords that are convenient to use. All you have to remember is one password, the one to the manager itself. There are many password managers. They're usually fairly hard to understand and set up (do you have to hire a "programmer"?), and they [get criticized all the time](https://www.google.com/search?q=password+manager+was+hacked). Big companies have long known how to solve these problems. They have their own security specialists and [specialized solutions](http://www.rutoken.ru/). The owner of a small or medium business, though, can easily get lost in the technical details. I spent a little time and figured the subject out. Here's what I learned. ## Kinds of password managers These programs come for personal and for company use. There are local versions (all the data is stored on your computer or a local drive) and cloud ones. Local ones are said to be safer. These are, for example, [KeePass](http://keepass.info/) and [RoboForm](http://roboform.com/). With them you have to carry the password file around everywhere or put it on a server somewhere. The latter sharply reduces the point of a local manager, since your server is most likely not protected well enough. Kinda defeats the purpose. So, cloud ones. And naturally we're interested in managers that work for a company. What that means: we need to control which passwords are available to which employees; set how strong passwords must be; share them safely between employees in the same department, and so on. A company password manager has plenty of advantages: - It saves employees' time and effort, since they now need to remember only one password. - Secure passwords get used. - Passwords aren't passed around in private messages, on Viber or in Facebook DMs. - It saves the admin's time on "I can't get into XXX, help me reset my password". - It's easy to change passwords when someone leaves. - It's easy to hand passwords to a new employee. Of the cloud services with company features, I know two: [LastPass](http://lastpass.com) and [Dashlane](https://www.dashlane.com). Want details? See [Lifehacker's comparison (in a Russian translation on Siliconrus)](http://siliconrus.com/2015/01/best-password-managers/) or just search for it. If you set aside the indie products\* of small companies, only LastPass and Dashlane remain. And given that Dashlane costs twice as much, it's clear why I chose LastPass. \*Siliconrus once [promoted a service called Passwork](http://siliconrus.com/2015/03/passwork/), but there are fewer reasons to trust it than LastPass. Though it costs a little less. ## LastPass: strengths and weaknesses Earlier I wrote a short [review of what LastPass Enterprise can do](https://www.99rabbits.com/blog/lastpass-enterprise-for-a-small-company). Since then I've switched to a paid account, set it up for all employees, and turned on some policies and two-factor authentication. I found no particular drawbacks apart from the dated interface design. It's the oldest and largest manager. Of course, that makes it a tasty target for hackers. They were even breached in June, but nothing much was stolen and nobody was hurt. Careless journalists blew it up into news, though, and now everyone "knows" that "LastPass isn't safe" and keeps writing passwords on sticky notes. ## Summary Business owners and managers should think about a digital security policy for their companies. Storing and passing passwords around carelessly is a serious security threat. I recommend rolling out a company password manager. It's convenient, safe and saves time. I chose LastPass for myself, though there are alternatives. Figuring it all out isn't hard, but a business owner does need to spend some time on it.