,When discussing Password Management platforms, clients often wonder if it’s really necessary. However, it is worth taking a second look at what purpose a password manager serves, and why it is a wise investment in the fight to stop account compromise and the spread of ransomware. This simple tool, when combined with items like multifactor authentication (MFA) and general password hygiene, empowers employees to maintain unique, strong passwords, which remain the first line of defense against attackers.
What does a Password Manager do?
One of the biggest complaints from end-users regarding password hygiene is that it is almost impossible to remember long, complex passwords for all the accounts they need to do their jobs. It becomes especially difficult when they are required to reset these passwords every 6 months or so. It’s not surprising then, that many people end up writing down their passwords, choosing too simple passwords, re-use passwords, or never change them.
How does a Password Manager work?
A password manager is a secure software application designed to store and manage online credentials in one place. Beyond just storing a list of passwords, a good password management platform also generates complicated passphrases, auto-fills credentials, and may even assist in notifying end-users when a password has been compromised
So, how does a password manager help? Simply put, a password management platform greatly increases the odds that employees will follow organizational policies to maintain complex passwords that are unique to every account they use, because it makes it easy. Suddenly, users only have to remember one master password. The rest is nearly automated.
Does a Password Manager help with Ransomware?
The thing about ransomware is that it needs a way in. And there is no better way to get it spread throughout an organization than with compromised credentials. When end-users create weak passwords, and then reuse them for all sorts of applications and web-based accounts, the odds those passwords can be broken increase exponentially. Once that happens, it’s only a matter of time before a malicious individual leverages those credentials to gain a foothold in the organization’s network.
It is important to note that incidents happen even to organizations that have every security appliance, policy, and procedure in place. If end-users are diligent about using their password management platform, one compromised password can be easily changed. Without a password manager, days may be wasted simply trying to figure out what other accounts are still using the old password, and what additional damage is being inflicted by the attacker.
There is no silver bullet in Cybersecurity. However, when it comes to keeping accounts secure, a layered approach is best. So far, we’ve covered Password Hygiene, Multifactor Authentication, and now Password Managers. Combining the right products, and attitude towards protecting accounts, will increase the security posture of any organization, no matter the size or industry.
For the next cybersecurity post, I’ll talk about implementing policies and procedures, and how maintaining documentation reduces an organization’s risk. Thank you for reading another Back to Cybersecurity Basics blog. If you are interested in having a conversation about Cybersecurity, we would love to hear from you!
Remember, Cybersecurity is a long journey, but it is one worth starting today!
Michael Wallace
Cybersecurity Consultant
