Must-Read for IT Managers! How to Strengthen Password Management in Your Company

Are you leaving password management up to individual employees? Many
cyberattacks start by exploiting weaknesses in password practices—often due to
human error or poor internal management. If your company’s password policies are
too lax, a single compromised account could lead to a major data breach. In this
article, we’ll break down five key strategies IT professionals should implement
to strengthen internal password management. From realistic policy setting based
on the latest NIST guidelines, to effective tool usage and employee education,
we’ll cover practical steps you can take to protect your organization.

Why Is Password Management Important?

Many corporate security risks stem from poorly managed passwords. Weak or reused
passwords often become targets for cyberattacks. Phishing attacks and credential
leaks are increasing, leading to unauthorized access that can cause significant
damage to businesses.

Five Key Points to Strengthen Password Management

1.Establish and Enforce a Password Policy

To maintain password strength while minimizing user frustration, consider
adopting the following rules based on recommendations from NIST (National
Institute of Standards and Technology):

• Minimum password length of 8 characters (using 15 characters or more in a
  passphrase format is highly recommended)
• Mixing uppercase, lowercase, numbers, and symbols is optional (length is more
  important than complexity)
• Regular password changes are not required (unless there’s evidence of
  compromise)
• Disallow the use of known leaked passwords (compare against breach databases
  where possible)
• Avoid reusing passwords across multiple systems (especially for work-related
  accounts)

NIST’s latest guidelines emphasize length over complexity and maintaining
secure passwords over enforcing periodic changes. Forcing regular updates
often leads to predictable patterns (e.g., Spring2024! → Summer2024!), which can
weaken security rather than enhance it.

2.Implement Multi-Factor Authentication (MFA)

MFA significantly reduces the risk of unauthorized access, even if a password is
compromised. Consider using:

• One-time passwords (OTP)
• Authentication apps (such as Microsoft or Google Authenticator)
• Hardware tokens

3.Utilize a Password Manager

Password managers such as Zetetic
Codebook
(eSolia’s choice) or 1Password help employees generate and store strong
passwords securely, in an encrypted database application. Benefits include:

• Automatic generation and secure storing of strong passwords
• Preventing password reuse
• Checking if your passwords were leaked in a security breach
• Ease of entering your passwords when requested

4.Strengthen Access Control

Apply the Principle of Least Privilege (PoLP) by granting only necessary
access rights, and consider “Just in Time” access rights allocation solutions,
such as M365 PIM. Additionally:

• Regularly review access permissions
• Properly manage accounts of former or transferred employees

5.Employee Education and Regular Security Training

Password security is not just an IT issue; all employees should understand its
importance. Conduct training on:

• Identifying phishing emails
• Raising awareness of security best practices
• Simulated attacks to test employees’ responses

At eSolia, in addition to taking part in security training, all employees create
a monthly quiz based on articles from the magazine Nikkei Network, covering a
wide range of IT and security topics. These quizzes are then delivered daily
through TMC, our attendance and work tracking app, in a True/False format. This
unique initiative helps reinforce both security awareness and overall IT
knowledge as part of our everyday workflow.

Conclusion

Strengthening password management is a fundamental part of corporate
cybersecurity. IT managers and decision-makers must lead efforts in setting
policies, implementing security tools, and educating employees. Start by
assessing your company’s current password management practices and take steps to
enhance security today!

At eSolia Inc, we provide reliable IT support services for businesses as an
outsourced IT department. If you’re considering IT outsourcing, feel free to
contact us for more information.