Regain
Control Over
Your Infrastructure
A crisis is never a good time to be searching for login credentials
About a month ago a client called me in a panic asking me if I had the login credentials to their web hosting account. They were desperately trying to solve a website problem and no one knew where the credentials were located. This seems to happen regularly with small businesses as they grow, especially when the company founders created the accounts. I maintain all relevant credentials for my clients that are under a maintenance contract. In this case, they weren’t a regular client and there was little I could do to help. They would spend the next several days trying to contact previous vendors and unlock the accounts they needed.
A good Business Continuity Plan includes provisions for inventorying and regularly auditing all company accounts and passwords. My clients tend to be small businesses and often struggle with operational planning. This planning does take effort and time but can save time and stress infrastructure issues occur. Good organizational planning is key to growing a business.
Inventory All Login Accounts
It is easy to underestimate the sheer number of online accounts that a company can acquire. Take some time and generate a list of all of the online accounts that your company is using. Everything from web domain services, e-mail, web hosting, financial, analytics, social media, supplier, and vendor accounts should be on this list.
How did you do?
Were you able to list all of the online accounts that your company uses? Do you know who inside your company created and controls each of these accounts?
Reset or retrieve any missing or lost accounts
Sort Accounts By Importance
Not every login or online account is related to a critical business function. Sorting through your list of logins will help you better understand which accounts need to be protected. The following chart is a guide to help you with evaluating the importance of commonly held accounts.
Critical
Accounts on this list are required for the daily operation of your business. A loss in the control of these accounts can have an immediate financial impact.
Web Domain Registrar
Point of Sale Systems
Credit Card Processing
Banking or Financial
Important
Accounts on this list are important for the daily operation of your business. A loss in the control of these accounts will result in a future financial impact.
Web Hosting
Website Backend
Webmaster Tools
Supplier Web Logins
Optional
Accounts on this list are optional for the daily operation of your business. A loss in the control of these accounts may or may not result in a future financial impact.
Social Media
Vendor Web Logins
The more critical the account, the more difficult it can be to recover
Recovering lost or stolen credentials for any critical account can be extremely difficult. Store all critical account credentials in a secure location with access limited to a few trusted people. Having a single person be the sole holder of accounts is inherently risky.
Use A Cloud-Based Password Manager
A password manager is a tool that stores your login credentials for all the websites you use securely and will help you log into them automatically. Password Managers store your information in an encrypted database which can only be accessed using a master password. You can share this private data safely with co-workers, across departments, or the entire company.
Reasons for using a password manager across your business
- One repository for all credentials
- Auto generate strong passwords
- Compromised password notification
- User and group access control
- Auto login on most devices
- Prevents password reuse
- Credentials can be shared securely
- Audit credential use by employees
- Support two-step logins
Password Manager Drawbacks
- Setup Time
- Some websites block use
- Generated passwords are hard to type
- Employee training
- Two-step login sometimes fails
The ability to store logins in a central location and share them securely more than outweigh the drawbacks of using a password manager.
Some Recommended Password Managers
The following password managers are reviewed favorably from trusted industry news sources. I do not receive compensation from the developers of these applications, and I feel that any on this list are good choices. I am currently using Bitwarden, and I find that it works well in my environment. I support OpenSource based software products whenever possible.
Need Help With Setup?
All of the recommended password managers are well-designed products. Regardless of what product you choose, time is needed to learn how to use them effectively. Businesses with a large number of online accounts will take time to set up. I am happy to set up your company-wide password vault using some hours of labor from an existing maintenance contract or as a one-time consulting engagement.