A secure business aims to achieve a few fundamental standards when it comes to protecting its passwords.
- No password should ever be stored or shared in plaintext
- Password should be strong enough to withstand brute-force attacks even if they’re stolen
- Access to organizational assets should be granted only if needed and revoked as soon as the need is served
- Employees as well as employers are trained to recognize and thwart social engineering attacks
Password management is the process that allows businesses to achieve these standards consistently and with minimum hassle to the workers as well as operations. Password security is important because passwords, as well as human beings, are soft targets for hackers.
Without the password best practices in place, even the strong passwords protected by the best encryption are not enough to protect a business from being compromised. Before delving into the best practices for better password management, it’s important to understand what happens when a password gets stolen and how different levels of security impact the results of a breach.
One must recognize that it is almost impossible to create a perfectly secure organization, so, what really matters is that an organization is secure enough to discourage hackers and drive them to the next target.
How can a hacker steal passwords?
An organization has two kinds of passwords to protect.
One: Customer credentials
These are usually hashed, salted, and stored in a database or an active directory.
Two: Employee Credentials
These are the credentials used for accessing different applications and resources used by organizations – CRMs, CMSs, communication platforms, and project management platforms, for instance.
Hackers can try to steal employee credentials through social engineering attacks like phishing, baiting, or water-holing.
They can exploit vulnerabilities like weak authentication, missing access controls, or lack of input validation to breach an LDAP active directory to steal customer credentials. They can use injection attacks to breach the database containing passwords.
If hackers can get their hands on plaintext passwords, they can sell them on the dark web straight away. If the passwords are hashed, they’d have to implement maneuvers like password cracking and brute force attacks to reveal the real passwords.
Businesses can make the job extremely hard for hackers by implementing certain password management best practices.
Enterprise Password Management Best Practices for Businesses
An organization is responsible for the protection of both customer credentials and employee credentials. However, securing the databases or directories containing customer credentials is not really a part of password management. The company’s overall cybersecurity posture as well as specific security measures are responsible for that.
In this post, we will focus on the best practices an organization can follow to ensure the protection of employee credentials and privileges.
Clear password security policies
Password policies should be a part of the onboarding information kit for employees regardless of their department or role. The policies should be clear, easily understandable, and intuitive.
The guidelines can include instructions related to
- Password creation and storing
- Password sharing
- Enablement of two-factor authentication or multi-factor authentication for every account
- Periodic password changes
Instructions about password quality
Employees should have clear guidelines about the qualities their passwords should have – like password length and character diversity. These instructions can be changed from time to time as the password security landscape evolves.
Some model instructions could be
- Password should be at least 12 characters long and include at least 3 character types
- The same password or slight variations of a password cannot be used for multiple accounts
- Common password patterns like a combination of a name and a year should not be used while creating passwords
- Common keyboard patterns like “asdfgh” or “qwerty” should not be used.
Shadow IT monitoring
A lot of employees use cloud-based applications or personal devices to ease up their work without the knowledge or approval of the IT department. This poses a security risk to the organization since the enterprise-level security measures do not apply to those personal applications or devices. Such resources are called shadow IT.
While it may be difficult, even counter-intuitive to forcefully stop the usage of shadow IT, it is important to bring such resources under the vigilance of the IT department through shadow IT monitoring platforms.
Policies must be created to integrate tools and applications brought in by employees with the existing IT repertoire of an organization so that such tools can be easily assessed, secured, and approved.
Robust access controls
The IT department should be aware of all the privileges granted to specific employees or groups and they should be able to follow the access trail for all organizational resources and detect any unauthorized access.
Organizations should follow the principle of least privilege and streamline the process of granting and revoking role-based access to employees.
It is important to note, that the easier it is for an employee to request and gain access to a tool they need, the more efficient they will be. It will keep the resources secure without compromising employee morale or productivity.
Mandatory use of password managers
The primary function of a password manager is to store the login information and provide it whenever needed. The more secure password managers encrypt the passwords before storing them and require the users to provide a master password which acts as the decryption key.
Modern password management solutions offer features like secure password generation, and auto-filling of usernames, passwords, and payment information.
Really advanced password managers like Uniqkey come with features like secure password sharing and automated employee logins where the need for human intervention in the authentication process is almost entirely eliminated.
Using a password manager makes it easier to follow all the other security best practices as well as reduce the impact of a data breach.
- Removes the possibility of creating weak passwords or repeating the same passphrase
- Ensures that passwords are never shared in plaintext
- Makes it easy to create Role-based access controls for employees
- Eliminates the need to remember unique passwords
- Improves overall password hygiene
Conclusion
The successful implementation of password best practices for a business requires the active participation of employees across the organization. Leaders must take meaningful steps to make it easier for everyone to understand and follow the password security protocols.
A powerful password manager built with a focus on efficiency and ease of use can make it very easy to implement a strong password policy without affecting efficiency. Password security is the last line of defense against cyber attacks on human workers – it deserves all the attention possible.
