Difference between revisions of "Password Management"

From Help Wiki
m (Clarified that the cloud based database in Last Pass is stored in an encrypted format that is not visible to Last Pass employees.)
(remove NIST statement)
 
(6 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
===What Is a Password Manager Tool?===
+
=== Updated Password Requirements (Washington State Alignment) ===
−
A password manager tool is software that helps users encrypt, store, and manage passwords.
+
The Evergreen State College has updated its [https://helpwiki.evergreen.edu/wiki/index.php/Change_My_Evergreen_Account_Password password requirements] to align with Washington State security standards. These standards emphasize improving real-world security while reducing user burden. 
−
The tool also helps users create secure passwords and automatically log in to websites.
+
  
−
===Who Might Use a Password Manager Tool, and Why?===
+
=== Password Managers ===
−
Users should employ unique passwords for each website or system to help minimize the impact
+
With these updated requirements, users are encouraged to adopt a password manager to securely store and generate strong, unique passwords. 
−
from the breach of one website or system; however, most users cannot remember a separate
+
−
password for many sites and tend to use the same password or write them on a sticky note
+
−
attached to their computer. Additionally, organizations may have passwords that need to be
+
−
shared across teams and want a secure method to do so. Password manager tools allow users to
+
−
more securely manage many distinct passwords and automatically log them in to websites.
+
  
−
===The Benefits of Using a Password Manager Tool===
+
==== Why Use a Password Manager? ====
−
Password manager tools enable users to create and securely maintain unique passwords for
+
* Generates strong, random passwords 
−
websites and other systems without having to memorize or write them down.
+
  
−
===Risks to Consider When Using a Password Manager Tool===
+
* Reduces password reuse 
−
Special care should be taken to secure the password tool, as it will grant access to all passwords.
+
−
The “master” password that grants access to the tool should be very strong and unique, and
+
−
multifactor authentication should be used if possible. Additional considerations include
+
−
whether you want your password management tool to store the passwords locally or in the
+
−
cloud.
+
  
−
===List of Technologies and Tools That a User Might Consider===
+
* Securely stores and autofills credentials 
−
Below are three popular password manager tools that an end user might consider for use. In
+
−
addition, some vendors provide enterprise versions, which allow centralized control of all
+
−
accounts within the organization. Users should evaluate which tool works best for their own
+
−
unique purposes. Neither EDUCAUSE nor HEISC (or Evergreen) recommends a particular tool; users employ
+
−
these tools at their own risk.
+
−
*'''[https://www.lastpass.com/ LastPass]''' is easy to use, supports most popular browsers and mobile devices, offers multifactor
+
−
authentication options for the master password and notifications for hacked sites, does not
+
−
share the encryption key with LastPass, provides a password strength indicator, and performs
+
−
additional password tests such as ensuring you’re not using the same password across multiple
+
−
sites. The ease of use requires that the password database is stored in the cloud, however it is stored in an encrypted zero knowledge format which means the contents are not visible to LastPass employees.
+
−
Additionally, as a web-based tool, your password database is available to anyone with an
+
−
Internet connection and your master password. For this reason, it is strongly recommended that
+
−
you use multifactor authentication.
+
−
* '''[https://keepass.info/ KeePass]''' does not share encryption keys with KeePass, but it provides a password
+
−
strength indicator. The password database is not stored in the cloud. Use across multiple
+
−
devices is a little more complex, as the user needs to maintain access to the private password
+
−
database manually.
+
−
* '''[https://1password.com/ 1password]''' does not share encryption keys with 1Password, but it provides a password strength
+
−
indicator. The password database can be stored in Apple’s iCloud, through Dropbox, or locally
+
−
on personal devices. Use across multiple devices is simple if stored in the cloud but more secure
+
−
if stored locally. The iOS version can be configured to support Touch ID on compatible devices.
+
  
−
===Higher Education Reference Pages===
+
* Helps comply with Evergreen and state security expectations 
−
* [http://www.bu.edu/infosec/howtos/password-management/ Boston University]
+
Strong password usage is one of the most effective protections against unauthorized access and cyberattacks. 
−
* [https://protect.iu.edu/cybersecurity/safeonline/passphrases/vaults Indiana University]
+
−
* [http://community.pepperdine.edu/it/security/password/passmgrs.htm Pepperdine University]
+
−
* [http://www.purdue.edu/securepurdue/pswdManager.cfm Purdue University]
+
−
* [https://security.illinois.edu/content/use-password-manager University of Illinois at Urbana-Champaign]
+
−
* InCommon webinar: [http://www.incommon.org/iamonline Security Awareness for User Authentication: Passwords and Beyond] (October 9, 2013)
+
  
 +
==== Browser Password Managers (Not Recommended) ====
 +
While convenient, the college does not recommend relying on browser-based password managers (such as Chrome, Edge, Firefox, or Safari) as a primary solution. 
  
 +
'''Key Concerns''' 
 +
* Weaker security models 
  
−
'''Source:''' [https://library.educause.edu/resources/2015/7/password-managers Educause / HEISC]
+
* Often lack zero-knowledge encryption or advanced protections  
 +
 
 +
* Exposure to browser-based threats 
 +
 
 +
* Browsers are common targets for malware, phishing, and malicious extensions  
 +
 
 +
* Credential/key storage risks 
 +
 
 +
* Encryption keys may be stored in predictable or accessible locations  
 +
 
 +
* Shared attack surface 
 +
 
 +
* Passwords are stored in the same environment used for web browsing, increasing risk 
 +
 
 +
* Limited enterprise features 
 +
 
 +
* Lack secure sharing, auditing, and organizational controls 
 +
Browser managers are better than reusing passwords - but dedicated password managers provide significantly stronger protection. 
 +
 
 +
==== Recommended Password Managers ====
 +
The following tools are commonly recommended for Evergreen users. These recommendations are non-binding and do not constitute official endorsement or support. Additional details are available through the provided links.
 +
{| class="wikitable"
 +
!Tool
 +
!Best For
 +
!Key Points
 +
!Use Cases
 +
|-
 +
!'''[https://1password.com/ 1Password]'''
 +
|Most users across devices
 +
|Cross-platform; strong security; autofill, sharing, sync
 +
|Multi-device users; teams; easy all-in-one solution
 +
|-
 +
!'''[https://keepass.info/ KeePass]'''
 +
|Advanced / security-focused users
 +
|Free, open-source; offline; highly customizable
 +
|No cloud preference; IT/technical users
 +
|-
 +
!'''[https://support.apple.com/en-us/120758 Apple Passwords]'''
 +
|Apple-only users
 +
|Built-in; sync via iCloud; autofill + alerts
 +
|Apple ecosystem; simple, no-cost option
 +
|}
 +
==== Summary ====
 +
* Evergreen is aligning with Washington State password standards  
 +
 
 +
* Password managers are strongly encouraged to support secure practices 
 +
 
 +
* Dedicated password managers are preferred over browser-based options 
 +
 
 +
===== Additional Guidance =====
 +
* Never share your password with anyone 
 +
 
 +
* Enable MFA wherever possible 
 +
 
 +
* Report suspected compromised accounts immediately to IT  email: support@evergreen.edu or call: (360) 867-6627
 
[[Category:Network]]
 
[[Category:Network]]
 +
[[Category:Security]]

Latest revision as of 14:19, 15 June 2026

Updated Password Requirements (Washington State Alignment) 

The Evergreen State College has updated its password requirements to align with Washington State security standards. These standards emphasize improving real-world security while reducing user burden. 

Password Managers 

With these updated requirements, users are encouraged to adopt a password manager to securely store and generate strong, unique passwords. 

Why Use a Password Manager? 

  • Generates strong, random passwords 
  • Reduces password reuse 
  • Securely stores and autofills credentials 
  • Helps comply with Evergreen and state security expectations 

Strong password usage is one of the most effective protections against unauthorized access and cyberattacks. 

Browser Password Managers (Not Recommended) 

While convenient, the college does not recommend relying on browser-based password managers (such as Chrome, Edge, Firefox, or Safari) as a primary solution. 

Key Concerns 

  • Weaker security models 
  • Often lack zero-knowledge encryption or advanced protections  
  • Exposure to browser-based threats 
  • Browsers are common targets for malware, phishing, and malicious extensions  
  • Credential/key storage risks 
  • Encryption keys may be stored in predictable or accessible locations  
  • Shared attack surface 
  • Passwords are stored in the same environment used for web browsing, increasing risk 
  • Limited enterprise features 
  • Lack secure sharing, auditing, and organizational controls 

Browser managers are better than reusing passwords - but dedicated password managers provide significantly stronger protection. 

Recommended Password Managers 

The following tools are commonly recommended for Evergreen users. These recommendations are non-binding and do not constitute official endorsement or support. Additional details are available through the provided links.

Tool Best For Key Points Use Cases
1Password Most users across devices Cross-platform; strong security; autofill, sharing, sync Multi-device users; teams; easy all-in-one solution
KeePass Advanced / security-focused users Free, open-source; offline; highly customizable No cloud preference; IT/technical users
Apple Passwords Apple-only users Built-in; sync via iCloud; autofill + alerts Apple ecosystem; simple, no-cost option

Summary 

  • Evergreen is aligning with Washington State password standards  
  • Password managers are strongly encouraged to support secure practices 
  • Dedicated password managers are preferred over browser-based options 
Additional Guidance 
  • Never share your password with anyone 
  • Enable MFA wherever possible 
  • Report suspected compromised accounts immediately to IT email: support@evergreen.edu or call: (360) 867-6627
Retrieved from "http://helpwiki.evergreen.edu/wiki/index.php?title=Password_Management&oldid=48405"

The Evergreen State College