Introduction

Many businesses must comply with some federal mandate in regards to securing their customer or patient’s information.  These rules, while extensive, are very helpful in maintaining the security of your network.  Below is the standard policy surrounding password management.   We offer solutions below in the “Password Management Policy” section for your team to maintain compliance.

Unfortunately, there is no way of enforcing these rules unless you use a centralized authentication management system, like traditional AD or Azure AD.  Read more about “password management policy” in the section below.  For those trying to establish a password management system for your personal life or your organization, it is vital to know that not all password management systems are created equally.  Here are a couple we recommend for very different reasons.

Table Of Contents

Do you have a Managed Service Provider?

Your IT team should have a documentation system and password management system for storing all your passwords and documents. This is a quick way to establish a collaborative portal for sharing sensitive information rather than a plain-text Word document. Plain-text documents and spreadsheets are simply a recipe for disaster. Again, defer to the Password Management Policy for meeting federal guidelines and avoiding a catastrophic situation.

What is the ideal password manager?

Bitwarden for the win.  We mention Keepass below, but that is not ideal for the general public.

BitWarden Basic Free Account

This free accountis not secure out of the box.  A master password that is not your generic go-to password but that contains password complexity and must be memorable.  Use it once.  Use it as your master password for BitWarden.

How do I secure my all my user account passwords?

Every password must be unique.  I repeat, no user account created on the web, in the business world, on the computer, at home, or wherever must be unique.  The struggle, of course, is trying to remember on the fly.  The flexibility of downloading and installing the Bitwarden application for your desktop computer and phone should place those fears at bay.

Just copy and paste the computer-generated passwords through the Bitwarden application whenever you are prompted on the phone or the computer for that particular password.

What else should I know?

Yes, you must enable MFA (Multi-Factor Authentication) for Bitwarden. This will provide the extra level of security necessary for today’s internet. Here are the choices.

• Microsoft Authenticator: Use this if using Microsoft 365.
• Google Authenticator: Popular, but I personally am not a fan.
• Authy: It syncs with your desktop, but a novice user may need help with it. Please establish your go-to multi-factory authentication program.  Do not forget the master password, and store the backup codes.

Keepass Pro 

Several years ago, we suggested Keepass Pro as a free password manager (skip past this section to Password Policy to fully understand how to maintain proper password management).

While Keepass Pro is still very much in use because of its flexibility, it should not be used by the general public unless you know what you are doing. Make sure the password file is constantly being backed up, and don’t forget the master password!

The Non-Web Dependent Platform for Securing Your Passwords

There are plenty out there, but one we have seen that could be more heavily marketed or maintain a low profile in the marketplace.  It is secure and is pretty easy to use. This management program we recommend is Keepass. The Mac version that we recommend is Keepass X.

• Keepass PC
• Keepass X for Mac
• MacPass for Mac (secondary option)

 Keepass Illustration Tip For Mac

Keepass database file for Acme Widgets Inc.

The individual or organization maintains their own copy called AcmePersonal. Acme Widgets Inc. should request an updated database file emailed to them from time to time.   This database file is also known as the KDBX file.

How Do I View Passwords on My Phone?

Use a cloud-based app in conjunction with Keepass

See OneDrive, Synology Drive, Google Drive, or DropBox.

Your IT Guy

They maintain a database file called AcmeIT or whatever name that will differentiate one database file from another.

Two Database Files for Keeping Passwords Safe

The IT guy maintains their own, and you defer to your own for your updates.  The two files can’t sync or merge, but hey, it’s free, and people like it.  Again, have your IT guy email the latest and greatest database file.  Then, save the old IT database file.

The Do’s and Don’t (s)  of Password Management

• Do keep meticulous notes
• Don’t have old notes lingering as if they are current.  Place a Zzz to note that they may be somewhat relevant but otherwise inactive.

Password Management Policy

Policy:We require the following password and credential management:

• All passwords must be changed at least once every 90 days.
• The Security Officer’s administered global password management database must contain all production system-level passwords.
• User accounts with system-level privileges granted through group memberships or programs must have a unique password from all other accounts held by that user.

Users must select strong passwords. Strong passwords have the following characteristics:

• Be at least eight characters in length
• Be a mixture of letters and numbers
• Be changed at least every 90 days
• Be different from the previous six passwords
• Not contain the user’s user ID
• Passwords must not be inserted into email messages or other forms of electronic communication.

Note that poor, weak passwords have the following characteristics: 

• The password contains less than six characters
• The password is a word found in a dictionary (English or foreign)
• The password is a common usage word such as:
  • Names of family, pets, friends, co-workers, fantasy characters, and so on
  • Computer terms and names, commands, sites, companies, hardware, software
• Birthdays and other personal information such as addresses and phone numbers
• Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, and so on
• Any of the above spelled backwards
• Any of the above preceded or followed by a digit (for example, secret1, 1secret)

Further, systems that authenticate must require users’ passwords and must also block access to accounts if more than three unsuccessful attempts are made.

 Members of the workforce must follow these guidelines for passwords:

• Don’t reveal a password over the phone to ANYONE
• Don’t reveal a password in an email message
• Don’t talk about a password in front of others
• Don’t hint at the format of a password, like “my family name.”
• Don’t reveal a password on questionnaires or security forms
• Don’t share a password with family members
• Don’t reveal a password to co-workers
• Don’t ‘hide’ a password within view at your work area, on a badge, or under a mouse pad or keyboard.”

Password Management Q&A

Password Management Q&A

You now know a business needs a password policy to maintain compliance, but password management could be very beneficial in many other ways.   Ask yourself, “Do I have plenty of passwords to sites, subscriptions, bank accounts, and computers?  Do I struggle to keep up with all the passwords associated with my life or business?”

The answer is yes, unless you are completely off the grid and living the lifestyle of a hermit.

As your digital footprint increases, you accumulate more passwords and sensitive information related to those password credentials. How can you be sure that the platform you use is the most ideal and secure way to access your sensitive information? There is no silver bullet for secured password management, but we can discuss many of the do’s and don’ts of password management.

Password Management Personalities

• The pen and paper individual
  • This method of “password management” is the most common. Paper typically gets lost, and the notes on it become disorienting and nonsensical. However, some people simply don’t use the computer enough or establish a proper workflow with it. Therefore, the issues with using paper become just as bad in the digital world.
    • Recommendation: Pray for this person. Document your passwords if you work with them because this person is not dependable for password management.
• Word or Google Doc individual
  • This is the second most common method for password management. Many people use this method religiously, but this workflow is a welcome mat for hackers to wreak havoc on their lives.
    • Recommendation: Find a secure password management system. We recommend a less common platform; perhaps a non-web-dependent platform would give a more warm, fuzzy feeling of privacy and security.
• The Phone App Password Management Program
  • This method is gaining a lot of momentum, but with convenience comes more security issues.
    • Recommendation: We recommend a less common platform. Perhaps a non-web-dependent platform would give a more warm, fuzzy feeling of privacy and security.

Password Management Policy Summary

Password management is not only suitable for compliance but is also a preventive measure against security breaches. If you have concerns about your data security, contact us today to see how we can help you boost your cyber protection.