The typical user has to manage nearly 100 passwords, far too many to remember. That often results in a constant cycle of time-consuming resets.
The alternative is adopting a password management platform. Password managers store passwords securely, requiring users to remember only a master password to access the tool.
MSPs not only use password management platforms for their own businesses, but also to protect their clients. It’s also a surprisingly simple way to meet compliance regulations and strengthen overall security by standardizing the storage of user credentials and reducing the risk of breaches.
Felicia King
Choosing a Password Manager
When looking at the various options, MSPs should consider features such as:
• Multifactor authentication (MFA) functionality
• Preventing password reuse
• Alerting users of breached passwords
• Audit oversight for administrators.
Letting users know when a password has been exposed, or that a password is weak or insecure is a must-have feature, according to Felicia King, president of Quality Plus Consulting.
“It is critical that end users be empowered with this data and be trained on how to handle breached passwords and insecure or reused passwords. Information security risk management is everyone’s responsibility.”
Jayson Ferron
An intuitive interface is also important. Otherwise, users tend to get frustrated, King said. “To get staff to use a security product, it must be intuitive and user-friendly.”
The platform should have cross-platform functionality. As with any other security tool, password managers exist in hybrid environments with multiple operating systems, mobile devices, and browsers. The tool needs to interact with these various platforms, both from the user and administrator perspectives.
Administrators always are better off when the data they need to manage is consolidated in one location, according to Jayson Ferron, chief technologist at Interactive Security Training. If they have to switch between screens to view data in different silos, things get complicated, he said. Complexity is the enemy of good security.
Kevin Beaver
Vet the Vendor
Sadly, even security tools can be breached. That includes password managers.
So MSPs must properly vet these tools, said Kevin Beaver, an independent cybersecurity consultant and author of “Hacking For Dummies.”
“You’ll want to go with a vendor that has a history of minimal security incidents, if any. Of the incidents they did have, you’ll want to review how the vendor responded and made things right with their customers.”
To avoid such situations, choose a password manager that uses security certificates installed on local devices, Beaver advised. “In theory, even if the vendor is compromised, your passwords are kept safe.”
Image: iStock
