Workplace passwords: secure and practical
In my first week at an organisation, I found passwords on sticky notes attached to seven monitors. The challenge was clear: staff needed quick access to their systems, but the credentials were visible to anyone walking past.
My first advice was to remove the notes from the screens. That reduced their visibility, but a note in a drawer is not a complete security solution. Lasting improvement needs secure storage, appropriate permissions and clear procedures.
Short version: good password management makes signing in both easier and safer. Start with a business password manager, individual accounts and MFA. Agree how access is granted, removed and recovered in an emergency.
Make the secure approach easy to use
Reception staff often use several systems: practice software, imaging software, email and online portals. Simply asking people to remember stronger passwords does not solve that problem.
A password manager can generate and fill unique passwords. Choose a solution that supports permissions for individual staff and shared vaults. Personal subscriptions are not automatically suitable for sharing and managing business credentials.
At the time, I prepared a password manager proposal covering the product, budget and rollout. The lesson: allow time for explaining the change and assign responsibility for implementation. A plan in a folder does not change the working day.
Four parts of a practical foundation
Individual accounts and unique passwords. Give staff their own accounts wherever possible. Avoid shared credentials when the system supports individual access.
A business password manager. Store passwords in a suitable vault, with access based on each person’s role. Loose text files, spreadsheets and visible notes are poor alternatives.
MFA and convenient sign-in. Use multifactor authentication, passkeys, Windows Hello or appropriately configured SSO where supported. Aim for fewer separate sign-in steps while keeping control over access.
A staff departure procedure. Disable accounts and active sessions, remove shared-vault access and change shared passwords the person knew. Disabling their password manager account alone may not be enough.
What you can check today
- Are passwords visible on screens or in shared documents?
- Can each employee access only what their role requires?
- Is MFA enabled for email and administrator accounts?
- Who can recover access if the administrator is unavailable?
- Can you confirm which access has been removed when someone leaves?
Frequently asked questions
Is a password manager difficult for staff? A browser extension or app often makes signing in easier. Start with everyday systems and provide a short introduction. Consider both ease of use and permission management when choosing a solution.
What if an employee knows shared passwords? Removing vault access does not invalidate passwords they copied earlier. Change those shared passwords and check sessions, recovery addresses and other routes of access.
What changes after a security incident? Assess what may have been exposed and work from a clean environment. Replace affected passwords, revoke sessions and check MFA and recovery methods before restoring normal access.
More about incident recovery: ransomware at the office.
Want to know which access risks matter most in your office? I can help you choose a practical approach.