Choosing and rolling out a business password manager
Shared passwords in a spreadsheet are a risk. What a business password manager adds, how to choose one and how to roll it out to a small team in order.
Every small business has shared passwords: the supplier portal, the bank's second login, the website host, the domain registrar, the social media accounts, the Wi-Fi. In many offices they live in a spreadsheet, a notebook in a drawer, an email thread or one person's head. A business password manager replaces all of that with something safer and, done well, easier for everyone. Here is how to choose one and roll it out without disrupting the team.
Why the usual methods fail
- Spreadsheets and documents get copied, emailed and synced to personal devices. Anyone who ever had access may still have a copy, and an attacker who gets into one mailbox often finds it within minutes.
- Passwords saved in each person's browser are tied to that person and that computer. When they leave or the laptop dies, the business may lose access, and the company has no view of what is stored there.
- Reused passwords are the biggest risk of all: one leak from an unrelated website can open your email, your bank or your accounting system.
- One person who knows everything is a single point of failure, for security and for continuity.
What a business password manager adds
Personal password managers are good, but business versions add the features a company needs:
- Shared vaults or folders, so the accounts team sees the banking and supplier logins, the marketing person sees social media, and nobody sees what they don't need.
- Company ownership. The vaults belong to the business, not to the individual. When someone leaves, you remove their access and the passwords stay with you.
- Admin recovery, so a forgotten master password doesn't lock a team member out of everything permanently.
- Reports showing weak, reused or exposed passwords, so you can fix the worst first.
- Sign-in with your existing accounts in some products, for example Microsoft 365, which makes adding and removing people simpler.
Choosing one
Several well-known products serve small teams. Rather than pick on brand alone, check that the one you choose has: business or team plans with shared vaults; support for multi-factor authentication on the vault itself; apps for every device your staff use, including phones; a clear account recovery process; and a straightforward way to export your data if you ever change. Ask how the provider handles security incidents and read what it says publicly about how vaults are encrypted.
Rolling it out, in order
- Start with the owners and the shared accounts. Set up the company account, turn on multi-factor authentication for it, and create the shared vaults. Move the most important shared logins in first: email admin, bank, domain and website, payroll, accounting.
- Change the passwords as you move them. If a password has lived in a spreadsheet, assume it has been seen. Moving is the ideal moment to replace it with a long, unique one the manager generates.
- Bring staff in a few at a time. Show them how to install the browser extension and phone app, save a login and fill one. Ten minutes of help saves weeks of resistance.
- Move personal work logins next. Encourage staff to import the work passwords saved in their browser, then switch off the browser's own password saving for work profiles if your setup allows.
- Delete the old spreadsheet, including copies in email and cloud folders. As long as it exists, it is still a risk.
The vault password and multi-factor authentication
The master password is the one password people still have to remember, so it should be long: a short phrase of several unrelated words works well. Turn on multi-factor authentication for every user, using an authenticator app or a security key rather than text messages where you can. Our page on password and account security covers this in more detail.
When someone leaves
A password manager makes leavers much easier: remove the person from the business account and their access to shared vaults ends at once. Then change any shared passwords they used regularly, especially for banking and admin accounts, as part of the steps in our guide to Microsoft 365 offboarding.
Help setting it up
A password manager is one of the most effective security improvements a small team can make, and it also cuts down on lockouts and "who knows the login?" moments. If you would like help choosing one, setting up vaults and getting everyone on board, it is part of the managed IT services we provide to small businesses, together with protection against the phishing emails that try to steal those passwords in the first place. Call (213) 986-4855.