The Secret to Increasing Password Security
In my work with a wide range of businesses, I’ve noticed that sometimes even the most competent IT departments feel utterly lost when it comes to password security.
Sure, they know the importance of keeping passwords secure. They’ve heard the nightmare stories about high-profile phishing attacks and malicious hackers. And they know passwords should be changed on a regular basis and employees shouldn’t be using “password123” or keeping a written list of their passwords on a Post-it at their desk. But most don’t know how to enforce a strong password security policy, especially when the list of users who need to access programs and applications seems to be growing every day.
Even the term “password security” may make some employees uneasy as they anticipate having to remember an endless list of complicated passwords…and then having to remember to change them to new complicated passwords on a regular basis.
Believe it or not, working with these skeptical clients is actually one of my favorite parts of the job. Why? Because I get to be the bearer of good news: These days, increasing password security actually means having to remember less and even (this is the best part) having to do less.
An Easier System is a Safer System
The best password management systems will allow a business to effectively keep its users in line with its password policy requirements. With features like password auditing, administrators can easily see who knows what, which passwords are about to expire, and more. Automated password reset features set up passwords to expire and change after a certain period.
Good password management systems also allow provide users with a portal for single sign-on (SSO). With a single sign-on software solution, a user can log in each morning and then be taken to a page with all of their applications and programs (think Salesforce, Gmail, WordPress, etc.). With a single click, users are logged into the programs of their choice without having to enter a password or additional credentials for the rest of the day.
But how can such a system be more secure? Wouldn’t it be less secure to provide access to so many applications with only a single password? No. The secret? Multi factor authentication, or MFA. With MFA, a user must authenticate using at least two of three designated security factors: knowledge (something you know, like a password or pin), possession (something you have, like a code from a token or generated on your mobile app), and inherence (something you are, usually verified by a biometric scan of your fingerprint or iris).
Because MFA provides such security strength—it’s nearly impossible for an outsider to access a system protected by MFA—it allows for much more streamlined password processes. Single sign-on is just one example of this.
Creating an effective password policy has always been the easy part. Now, with tools like password management systems and multi factor authentication software, enforcing the policy—and making it a much stronger one—can be just as feasible.