Building a business case for password managers

Passwords have always been at the heart of data security policies, and often data security breach reporting as well. Be it the password re-use question, the too simple to crack versus too complex to remember debate, or, as I touched upon recently, whether passwords are old tech that should be sent to the security scrap heap.

The unravelling Heartbleed saga has brought the password problem to the fore once more for both enterprise users and consumers.

Wearing my small business security consultant hat, one of the arguments I often find myself on the receiving end of is that I shouldn't be recommending the use of password managers as a solution.

"They are OK for the consumer who has no business critical data to protect, but even then the adoption case is a marginal one in terms of the security they offer," I am repeatedly told by people who usually fall into one of two categories.

The first are security consultants who deal exclusively with the medium-to-large' bit of the SMB sector. No consultant in their right mind would recommend consumer-grade password manager software to this level of enterprise application. Just because they are not an acceptable fit with the bigger players, does not mean that the smallest enterprises cannot benefit from using them nor that they are inherently insecure.

This brings me to the second category: the password naysayers who want to sell you on some other method of authentication and access control. This second group will often use the 'all your eggs belong to us' argument. In that, putting all your passwords in one place creates a very attractive target for hackers.

I agree. If there was a compromise, it would be disastrous. Just like it would be if that small business was re-using passwords across services and one of them suffered a breach. Just like if the passwords being used were not strong enough to resist attempts to crack them. Just like so many data breach scenarios involve passwords.

Would I rather see every enterprise adopt tokenisation, multi-factor authentication method? Of course I would, but that ain't going to happen at the bottom of the enterprise sizing graph where money, time and technical knowledge are all too often in short supply.