Password manager for business teams: how to roll one out

A password manager for business is a tool that stores every work login in one locked vault, so staff no longer keep passwords in spreadsheets, chat threads or their heads. It also creates long, unique passwords for each account. If your team still shares a spreadsheet of logins, this is the single change that helps most. This guide shows how to pick one and get people to use it.

Why a shared spreadsheet fails

A spreadsheet looks cheap and simple. In practice it has no access control worth the name. Anyone who can open the file can see every login. When a person leaves, you cannot tell which passwords they copied. The file gets emailed, downloaded and saved on personal laptops.

A spreadsheet also does nothing to stop weak habits. People pick short passwords they can remember, then reuse them across many accounts. When one site is breached, attackers try the same login on other sites. That is how one small leak turns into a break-in at your email or bank.

The UK National Cyber Security Centre describes password overload as the root problem. Staff have too many passwords, so they cope by reusing or choosing easy ones. A password manager is its suggested answer: staff remember one strong secret, and the tool handles the rest.

Sources: UK National Cyber Security Centre, Password manager buyers' guide (ncsc.gov.uk, reviewed November 2018).

What to look for when you choose one

Do not pick on price alone. Check these points before you buy.

• Encryption. Stored passwords should be encrypted, and only the user should be able to unlock their own vault.
• Recovery. Ask what happens if someone forgets the master password, and who is able to reset it.
• Two-step sign-in. The manager itself should support multi-factor sign-in, since it guards everything else.
• Team sharing. You need a safe way to share a login with a group, with limits on who can view or change it.
• Audit tools. Look for reports on weak, reused or old passwords.
• Device support. It must work on the browsers and phones your staff already use. If it is awkward, people will go back to old habits.
• Vendor record. See how fast the vendor fixes security bugs and how it ships updates.

The NCSC also warns that a password manager is not perfect. It holds many secrets in one place, which makes it a target. Its view is that the benefits still outweigh the risk, as long as you protect the vault well.

Sources: UK National Cyber Security Centre, Password manager buyers' guide (ncsc.gov.uk).

How to roll it out in four steps

Start small. A phased launch avoids the confusion that makes teams give up.

1. Pilot with a few people. Choose a team of three to five. Let them find the rough edges in a week or two.
2. Move the shared logins first. Import the spreadsheet, sort the entries into shared folders by team, then delete the spreadsheet and any copies.
3. Reset the weak ones. Start with email, banking, cloud storage and admin accounts. Let the tool generate new passwords.
4. Train everyone in one short session. Show how to save a login, fill it in and share it. Name one person who can answer questions.

Pick a firm date when the old method stops. Without a date, the spreadsheet lives on beside the new tool.

Rules to set for your team

Keep the policy short enough to fit on one page. Good rules to include:

• Every work account gets a unique password made by the tool.
• The master password is long and used nowhere else.
• Two-step sign-in is switched on for the vault and for email.
• Shared logins sit in shared folders, never in chat or email.
• Managers remove access on the day a person leaves.

Resist the urge to force a password change every 90 days. The US standards body NIST, in its digital identity guidelines, says verifiers should not require changes on a schedule. It says to force a change only when there is evidence of a compromise. NIST also says to avoid strict composition rules, such as demanding a symbol and a capital letter. It asks that systems accept long passwords of at least 64 characters, check new passwords against lists of known breached ones, and allow pasting so that password managers work.

The NCSC gives the same advice. Forced expiry tends to push people toward predictable tweaks, such as adding a number to the end. Change a password when you know or suspect it has leaked, and watch for odd sign-in activity instead.

Sources: NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management, section 5.1.1.2 (pages.nist.gov/800-63-3); UK National Cyber Security Centre, Password policy: updating your approach (ncsc.gov.uk, reviewed November 2018).

How to keep it working

The launch is the easy part. Habits fade, so build in a little upkeep.

Run the tool's audit report every quarter. It will flag reused and weak passwords for staff to fix. Review who has access to each shared folder, and remove people who changed roles. Test recovery once a year, so you know it works before an emergency. Finally, ask your team what annoys them. A tool that people find hard to use will not be used, and any gap in use brings the old risks back.

If you only do one thing this month, retire the shared spreadsheet and move its logins into a manager. Your team will have fewer passwords to remember, and you will have a clear view of who can reach what.

Sources

• UK National Cyber Security Centre, Password manager buyers' guide: ncsc.gov.uk/collection/passwords/password-manager-buyers-guide
• UK National Cyber Security Centre, Password policy: updating your approach: ncsc.gov.uk/collection/passwords/updating-your-approach
• NIST SP 800-63B, Digital Identity Guidelines: pages.nist.gov/800-63-3/sp800-63b.html