Difference between revisions of "Password Management"

From Help Wiki
m (→‎List of Technologies and Tools That a User Might Consider)
(remove NIST statement)
 
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
===What Is a Password Manager Tool?===
+
=== Updated Password Requirements (Washington State Alignment) ===
−
A password manager tool is software that helps users encrypt, store, and manage passwords.
+
The Evergreen State College has updated its [https://helpwiki.evergreen.edu/wiki/index.php/Change_My_Evergreen_Account_Password password requirements] to align with Washington State security standards. These standards emphasize improving real-world security while reducing user burden. 
−
The tool also helps users create secure passwords and automatically log in to websites.
+
  
−
===Who Might Use a Password Manager Tool, and Why?===
+
=== Password Managers ===
−
Users should employ unique passwords for each website or system to help minimize the impact
+
With these updated requirements, users are encouraged to adopt a password manager to securely store and generate strong, unique passwords. 
−
from the breach of one website or system; however, most users cannot remember a separate
+
−
password for many sites and tend to use the same password or write them on a sticky note
+
−
attached to their computer. Additionally, organizations may have passwords that need to be
+
−
shared across teams and want a secure method to do so. Password manager tools allow users to
+
−
more securely manage many distinct passwords and automatically log them in to websites.
+
  
−
===The Benefits of Using a Password Manager Tool===
+
==== Why Use a Password Manager? ====
−
Password manager tools enable users to create and securely maintain unique passwords for
+
* Generates strong, random passwords 
−
websites and other systems without having to memorize or write them down.
+
  
−
===Risks to Consider When Using a Password Manager Tool===
+
* Reduces password reuse 
−
Special care should be taken to secure the password tool, as it will grant access to all passwords.
+
−
The “master” password that grants access to the tool should be very strong and unique, and
+
−
multifactor authentication should be used if possible. Additional considerations include
+
−
whether you want your password management tool to store the passwords locally or in the
+
−
cloud.
+
  
−
===List of Technologies and Tools That a User Might Consider===
+
* Securely stores and autofills credentials 
−
Below are two popular password manager tools that an end user might consider for use. Users should evaluate which tool works best for their
+
−
unique purposes. Neither EDUCAUSE nor HEISC (or Evergreen) recommends a particular tool; users employ
+
−
these at their own risk.
+
−
* '''[https://1password.com/ 1password]''' does not share encryption keys with 1Password, but it provides a password strength
+
−
indicator. The password database can be stored in Apple’s iCloud, through Dropbox, or locally
+
−
on personal devices. Use across multiple devices is simple if stored in the cloud but more secure
+
−
if stored locally. The iOS version can be configured to support Touch ID on compatible devices.
+
  
−
* '''[https://keepass.info/ KeePass]''' does not share encryption keys with KeePass, but it provides a password
+
* Helps comply with Evergreen and state security expectations 
−
strength indicator. The password database is not stored in the cloud. Use across multiple
+
Strong password usage is one of the most effective protections against unauthorized access and cyberattacks. 
−
devices is a little more complex, as the user needs to maintain access to the private password
+
−
database manually.
+
  
−
===Higher Education Reference Pages===
+
==== Browser Password Managers (Not Recommended) ====
−
* [http://www.bu.edu/infosec/howtos/password-management/ Boston University]
+
While convenient, the college does not recommend relying on browser-based password managers (such as Chrome, Edge, Firefox, or Safari) as a primary solution. 
−
* [https://protect.iu.edu/cybersecurity/safeonline/passphrases/vaults Indiana University]
+
−
* [http://community.pepperdine.edu/it/security/password/passmgrs.htm Pepperdine University]
+
−
* [http://www.purdue.edu/securepurdue/pswdManager.cfm Purdue University]
+
−
* [https://security.illinois.edu/content/use-password-manager University of Illinois at Urbana-Champaign]
+
−
* InCommon webinar: [http://www.incommon.org/iamonline Security Awareness for User Authentication: Passwords and Beyond] (October 9, 2013)
+
  
 +
'''Key Concerns''' 
 +
* Weaker security models 
  
 +
* Often lack zero-knowledge encryption or advanced protections  
  
−
'''Source:''' [https://library.educause.edu/resources/2015/7/password-managers Educause / HEISC]
+
* Exposure to browser-based threats 
 +
 
 +
* Browsers are common targets for malware, phishing, and malicious extensions  
 +
 
 +
* Credential/key storage risks 
 +
 
 +
* Encryption keys may be stored in predictable or accessible locations  
 +
 
 +
* Shared attack surface 
 +
 
 +
* Passwords are stored in the same environment used for web browsing, increasing risk 
 +
 
 +
* Limited enterprise features 
 +
 
 +
* Lack secure sharing, auditing, and organizational controls 
 +
Browser managers are better than reusing passwords - but dedicated password managers provide significantly stronger protection. 
 +
 
 +
==== Recommended Password Managers ====
 +
The following tools are commonly recommended for Evergreen users. These recommendations are non-binding and do not constitute official endorsement or support. Additional details are available through the provided links.
 +
{| class="wikitable"
 +
!Tool
 +
!Best For
 +
!Key Points
 +
!Use Cases
 +
|-
 +
!'''[https://1password.com/ 1Password]'''
 +
|Most users across devices
 +
|Cross-platform; strong security; autofill, sharing, sync
 +
|Multi-device users; teams; easy all-in-one solution
 +
|-
 +
!'''[https://keepass.info/ KeePass]'''
 +
|Advanced / security-focused users
 +
|Free, open-source; offline; highly customizable
 +
|No cloud preference; IT/technical users
 +
|-
 +
!'''[https://support.apple.com/en-us/120758 Apple Passwords]'''
 +
|Apple-only users
 +
|Built-in; sync via iCloud; autofill + alerts
 +
|Apple ecosystem; simple, no-cost option
 +
|}
 +
==== Summary ====
 +
* Evergreen is aligning with Washington State password standards  
 +
 
 +
* Password managers are strongly encouraged to support secure practices 
 +
 
 +
* Dedicated password managers are preferred over browser-based options 
 +
 
 +
===== Additional Guidance =====
 +
* Never share your password with anyone 
 +
 
 +
* Enable MFA wherever possible 
 +
 
 +
* Report suspected compromised accounts immediately to IT  email: support@evergreen.edu or call: (360) 867-6627
 
[[Category:Network]]
 
[[Category:Network]]
 
[[Category:Security]]
 
[[Category:Security]]

Latest revision as of 14:19, 15 June 2026

Updated Password Requirements (Washington State Alignment) 

The Evergreen State College has updated its password requirements to align with Washington State security standards. These standards emphasize improving real-world security while reducing user burden. 

Password Managers 

With these updated requirements, users are encouraged to adopt a password manager to securely store and generate strong, unique passwords. 

Why Use a Password Manager? 

  • Generates strong, random passwords 
  • Reduces password reuse 
  • Securely stores and autofills credentials 
  • Helps comply with Evergreen and state security expectations 

Strong password usage is one of the most effective protections against unauthorized access and cyberattacks. 

Browser Password Managers (Not Recommended) 

While convenient, the college does not recommend relying on browser-based password managers (such as Chrome, Edge, Firefox, or Safari) as a primary solution. 

Key Concerns 

  • Weaker security models 
  • Often lack zero-knowledge encryption or advanced protections  
  • Exposure to browser-based threats 
  • Browsers are common targets for malware, phishing, and malicious extensions  
  • Credential/key storage risks 
  • Encryption keys may be stored in predictable or accessible locations  
  • Shared attack surface 
  • Passwords are stored in the same environment used for web browsing, increasing risk 
  • Limited enterprise features 
  • Lack secure sharing, auditing, and organizational controls 

Browser managers are better than reusing passwords - but dedicated password managers provide significantly stronger protection. 

Recommended Password Managers 

The following tools are commonly recommended for Evergreen users. These recommendations are non-binding and do not constitute official endorsement or support. Additional details are available through the provided links.

Tool Best For Key Points Use Cases
1Password Most users across devices Cross-platform; strong security; autofill, sharing, sync Multi-device users; teams; easy all-in-one solution
KeePass Advanced / security-focused users Free, open-source; offline; highly customizable No cloud preference; IT/technical users
Apple Passwords Apple-only users Built-in; sync via iCloud; autofill + alerts Apple ecosystem; simple, no-cost option

Summary 

  • Evergreen is aligning with Washington State password standards  
  • Password managers are strongly encouraged to support secure practices 
  • Dedicated password managers are preferred over browser-based options 
Additional Guidance 
  • Never share your password with anyone 
  • Enable MFA wherever possible 
  • Report suspected compromised accounts immediately to IT email: support@evergreen.edu or call: (360) 867-6627
Retrieved from "http://helpwiki.evergreen.edu/wiki/index.php?title=Password_Management&oldid=48405"

The Evergreen State College