Why charities need to upskill their password management

While not exclusive to charities and non-profits, managing passwords and account details have historically been an issue that many will have come across, including our own clients. Often written down on a scrap of paper or stuck within the head of a specific person, it’s not always a priority to store credentials for important digital accounts safely, until it needs to be. We’ve got some tips for improving password management across your team below and give a few examples on why it’s such an important task.

TLDR: A password manager is like a lock box for your digital keys – it’ll help you keep hold of all your business critical login details, provide authentication, and also provide peace of mind.

Keeping your passwords secure

As we discussed in our last blog post, password managers are crucial to maintaining the integrity of your organisation’s login credentials. We’ll go in-depth on password managers a bit later – for now, let’s look at a few more issues that crop up when maintaining passwords across a team.

People sometimes share their passwords insecurely, often via plain text in an email. While email is usually encrypted during transmission, they’re stored as clear text, which makes them readable by bad actors (i.e. third parties who wish to use your data for nefarious purposes).

It’s also common for people to choose a password that’s easily memorable, or perhaps even reuse passwords across accounts. Both of these are big no-no’s, as not only do simple passwords make them more trivial to crack, but reusing passwords is an unnecessary security risk: the more you reuse your passwords, the more your digital accounts could ultimately become compromised.

One of our clients experienced such a compromise with their WordPress site: they’d chosen an insecure password for their login details that had been used across multiple accounts. When they uploaded an unknown plugin to their WordPress instance, this left a large gap in their account’s security and allowed a hacker to compromise their website. As well as providing some guidance and teaching to the client, we were able to resolve the issue by removing all the affected files and reinitiating their site. This and other examples have definitely encouraged us to strongly recommend to all of our clients that they use more secure measures for keeping their credentials, and ultimately one of their business critical assets, safe.

There’s an app for that

As we’ve previously mentioned, the best place to store your most important account details is within a password manager. Operating systems like Apple’s and Microsoft’s offer inbuilt password management software, as do many browsers. You can also purchase subscriptions to web and native apps, like 1Password.

With a password management app, you can group passwords by subjects, such as finance or infrastructure, then set limits on who can access them on a case-by-case basis. They will alert you if any of your accounts have been compromised, with a prompt to update your password, as well as suggesting more secure versions, if your sign-in details aren’t up to par.

Another great feature of password managers is that they typically allow you to share passwords with specific individuals – even sometimes third parties – via email verification. This can be set to a time limit so that people only have access to these details for the amount of time that’s absolutely necessary. They’ll also update users who do have access to login details when they’re updated.

Do you 2-factor?

You may or may not have come across 2-factor authentication before. This is where 2 forms of identification are required, alongside your usual login credentials, to provide more security to your digital accounts. It’s recommended to have this turned on for as many of your accounts as possible; for business critical accounts, it should be a requirement, as it’ll have a very negative effect on your business, should you lose your credentials or be a victim of hacking.

There are a number of ways to provide 2-factor authentication; however, the best way of doing so is by using some sort of authentication app, such as Google Authenticator, as SMS is unencrypted and can be vulnerable to phishing. If you’re using a password manager (something we highly recommend), you can also use this for authentication and to share it within your team.

Maintaining continuity within your organisation

It’s going to save you time and money in the long run if you implement a policy that requires your team to store all their passwords and logins within a central password manager. This will ensure they’re not lost if someone leaves the organisation. Also, as members of your team move on, you can remove their account privileges to prevent any unauthorised access.

Having core password storage means that business critical services, like your domain name and hosting services, are always available and can be renewed with ease. This wasn’t the case for a client of ours, who almost irretrievably lost their domain when their account details had been misplaced. They also weren’t aware of which domain registration service theirs was hosted by, which made correcting the issue even more difficult. Thankfully, we were able to offer our advice to help fix the problem and they did retrieve the domain. Having centralised credentials storage would’ve prevented the issue from happening in the first place.

Disaster recovery for when things go wrong

Note, we said “when” things go wrong in the title for this section, not “if.” With all the best will in the world, it’s inevitable that there will be some kind of security breach or account details forgotten at some point in a team’s life cycle, particularly if you’re not using some kind of software to manage and mitigate this.

Being able to track who was using a particular account at the time a breach or security failure takes place is invaluable when investigating what’s happened. Not to beat a dead horse, but password managers usually log when a person has either used account credentials or made a change to them. Having one also will allow those credentials to be updated quickly and universally for all users if they become compromised for some reason.

To sum up…

Hopefully, we’ve illustrated why it’s so important to store all of your important account credentials in a centralised place. If you don’t have a robust account credentials process in place, you risk some serious consequences, including interruptions to your organisation’s operations, reputational damages, costly resolutions and a lot of wasted time trying to fix issues. Not only that, but if a compromised account leads to a data breach, you may be liable for a fine from the ICO, if it breaches GDPR, which can equate to 4% of your annual worldwide turnover – definitely not a headache you’d want to deal with! If you want to save yourself some heartache, please do consider implementing a process of migrating your key organisational account credentials to a password manager.