Editorial · October 19, 2021
Password Managers: A Small Business Setup Guide
Password managers are the simplest fix for the most common login mistake: using one password in many places. A password manager is an app that makes a long, random password for every account and stores them all behind one strong master password. Staff only have to remember that one. This guide shows how a small business can set one up in a week.
Why reuse is the real problem
People reuse passwords because they cannot remember dozens of them. The trouble is what happens next. If one website is breached, criminals try the same email and password on other sites. One weak spot can open your email, your bank and your payroll tool. Small firms are not too small to be targeted, because automated attacks do not care who owns the account.
On October 1, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) kicked off Cybersecurity Awareness Month. It listed four easy steps for everyone. One of them was to use strong passwords, and ideally a password manager to generate and store unique passwords. The same list told readers to turn on multi-factor authentication, update software and think before they click.
Sources: CISA, "CISA Kicks Off Cybersecurity Awareness Month," October 1, 2021 (archived copy).
What password managers actually do
A good password manager does four jobs. It creates a random password for each site. It saves the password so no one has to type or remember it. It fills the login box on the right site only. It also keeps the list encrypted, so a thief who sees the stored data cannot read it without the master password.
Most business plans add a shared vault. A vault is a folder of logins that a team can open together. It lets the owner share the accounting login with a bookkeeper without sending it in an email or a text. When someone leaves, the owner removes that person from the vault instead of changing every password by hand.
What federal guidance said by 2021
The National Institute of Standards and Technology (NIST) publishes the rules that U.S. agencies use for digital identity. Its guide, SP 800-63B, was last revised in 2020. It does not tell people to invent complicated rules. It says sites should allow people to paste into the password box. The guide explains why: this helps password managers, which are widely used and in many cases make people pick stronger passwords.
The same guide gives other plain advice. A password chosen by a person should be at least 8 characters, and sites should accept 64 or more. Sites should not force odd mixes of symbols. They should not make people change a password on a schedule unless there is evidence it was stolen. For you, that means a long random password that stays put is better than a short clever one that changes every month.
Sources: NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management, section 5.1.1 (2017, updated 2020).
How to roll one out to staff
- Pick one tool. Choose a business plan with a shared vault, an admin panel and support for multi-factor authentication. Try it with two people first.
- Protect the master password. Use a long phrase of several random words. Do not use it anywhere else. Write the owner's copy down and keep it in a locked place.
- Turn on multi-factor authentication. Add it to the password manager itself and to email and banking. CISA's October 2021 release said it makes an account 99% less likely to be hacked.
- Move the big accounts first. Start with email, banking, payroll, the website host and social media. Replace each old password with a generated one as you go.
- Train in one short meeting. Show staff how to save a login, fill a login and share an item. Tell them never to send a password by chat or email again.
Common questions from owners
What if the password manager is hacked? Any tool can be targeted, which is why the vault is encrypted and the master password is never stored in readable form. A single strong master password and multi-factor authentication are far safer than dozens of reused ones.
What if someone forgets the master password? Set up a recovery option before you need it. Most business plans let an admin reset access, but only if you turn that on early.
Is a browser's saved-password feature enough? It is better than reusing passwords. A dedicated tool usually adds shared vaults, admin control and audit trails, which a growing team needs.
Start this week. Pick a tool, protect the master password, add multi-factor authentication and move your five most important accounts. That single hour removes most of the risk that comes from reused logins.
Sources: CISA, "CISA Kicks Off Cybersecurity Awareness Month," October 1, 2021; NIST SP 800-63B (2017, updated 2020).
Sources
- CISA, "CISA Kicks Off Cybersecurity Awareness Month," October 1, 2021: cisa.gov/news/2021/10/01/cisa-kicks-cybersecurity-awareness-month
- NIST, SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management: pages.nist.gov/800-63-3/sp800-63b.html