IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more
In-depth

Building a business case for password managers

Davey Winder ponders the best way for SMBs (and larger firms) to tackle the thorny issue of password security

Passwords have always been at the heart of data security policies, and often data security breach reporting as well. Be it the password re-use question, the too simple to crack versus too complex to remember debate, or, as I touched upon recently, whether passwords are old tech that should be sent to the security scrap heap.

The unravelling Heartbleed saga has brought the password problem to the fore once more for both enterprise users and consumers.

Wearing my small business security consultant hat, one of the arguments I often find myself on the receiving end of is that I shouldn't be recommending the use of password managers as a solution.

"They are OK for the consumer who has no business critical data to protect, but even then the adoption case is a marginal one in terms of the security they offer," I am repeatedly told by people who usually fall into one of two categories.

The first are security consultants who deal exclusively with the medium-to-large' bit of the SMB sector. No consultant in their right mind would recommend consumer-grade password manager software to this level of enterprise application. Just because they are not an acceptable fit with the bigger players, does not mean that the smallest enterprises cannot benefit from using them nor that they are inherently insecure.

This brings me to the second category: the password naysayers who want to sell you on some other method of authentication and access control. This second group will often use the 'all your eggs belong to us' argument. In that, putting all your passwords in one place creates a very attractive target for hackers.

I agree. If there was a compromise, it would be disastrous. Just like it would be if that small business was re-using passwords across services and one of them suffered a breach. Just like if the passwords being used were not strong enough to resist attempts to crack them. Just like so many data breach scenarios involve passwords.

Would I rather see every enterprise adopt tokenisation, multi-factor authentication method? Of course I would, but that ain't going to happen at the bottom of the enterprise sizing graph where money, time and technical knowledge are all too often in short supply.  

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

29% of UK SMBs cancelled cyber insurance policies in 2021
cyber security

29% of UK SMBs cancelled cyber insurance policies in 2021

9 May 2022
The total economic impact™ of Datto
Whitepaper

The total economic impact™ of Datto

24 Aug 2021

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
IT admin deletes company’s databases and is jailed for seven years
Policy & legislation

IT admin deletes company’s databases and is jailed for seven years

16 May 2022