The following info is provided to help you create a Password Policy.  Use the template as a guide, and make it work for your company.  

Texas Technician provides your company with a "Password Manager".  This program can be locked down, to the point where it can only be opened on a specific computer, if you see that being necessary.  

Something to keep in mind.  

The more "SECURE" you make something, the less secure it becomes.  Adding too many "road-blocks" will make your staff less likely to follow protocol.  

Example of an ineffective password policy:

Years ago I had a call at a large company.  I needed the password to the client's PC.  I asked the nice lady (the client) for their password.  

They lifted up the keyboard, and a dozen sticky notes fell down.

She riffled through them and said:  "I think it's this one!"

I asked why she had the password to her computer written on a sticky note, under the keyboard.  I also noticed that each sticky note was some iteration of:  Her-Dogs-Name-1a, Her-Dogs-Name-2a, Her-Dogs-Name-3a, ...

She stated:  "Our IT department makes us change our password every 30 days.  I can't remember it, so I have to write it down.  Everyone else does it too.  Just don't tell the IT guys..."

The IT department created an arbitrary and unnecessary road-block.  In the hopes of being "SECURE".  And unwittingly made their environment very insecure.  With this small bit of info, and my trusty laptop.  I could have guessed, by hand, every user's password.   

It's a program that manages your passwords :) 

More specifically, it's a purpose-built program.  Designed to be as secure as possible.

Password managers centralize your company's passwords in one secure database.  Depending on the password manager you chose, you can setup "Hierarchical or Granular Rights".  Meaning you can grant certain users access to only a few passwords.  

Example: HR only needs access to the passwords used in HR, but not the IT Department's passwords.

Password Manager Features:

• Centralize storage of passwords in an encrypted database.
• Generate passwords at the click of a button.
• Control who gets access to what passwords.
• Alert you when a password is about to expire.
• MFA, SSO integrations.
• Clipboard security:  When you copy a password from a manager.  Your computer's OS knows it is from a password manager.  And the entry in the clipboard is auto-deleted after a certain time.  (for KeePassXC the default time limit is 10 seconds).

There is a crazy amount of password managers.  Some of the best are FOSS (Free and Open Source Software).

Name:	Price Model:	Notes:
KeePassXC	FOSS	Works on all operating systems. Self-Hosted. MFA capable. Does NOT have Hierarchical or Granular Rights. Best for small operations, and personal use.
BitWarden	FOSS,  and "Freemium" (pay for advanced features)	Works on all operating systems. FOSS version supports most features you would need. Self-Hosted & an optional Cloud-Hosted option. MFA capable. SSO (single-sign-on) (Only available in Freemium version) Has Hierarchical and Granular Rights.  (Granular rights only available in Freemium version) Best for medium to large operations.

Storing passwords on external servers is not advisable; we utilize self-hosted password managers for enhanced security.

Key Advantages: 

• In case of a network failure, your local database remains accessible, ensuring uninterrupted access to your credentials.

• Regular backups of your database are made to your company's proprietary backup solution, offering an additional layer of security.

• Your encrypted password database, stored on your encrypted hardware and shielded by your own firewall, is less likely to be targeted than a company like LastPass (a password manager company).

 The LastPass Hack

Being small does not mean you are not a target.  You are, everyone is, a target to hackers.  But your password manager is more likely to be breached by an employee sharing their Password Manager's login credentials, than it is to be breached by an army of dedicated hackers.  

There's an endless way to hack passwords.  For brevity's sake, I'm going to list just a few.  If your interested in the crazy amount of ways you can be hacked.  Watch this:

Common Methods to Hack a Password:

1. Brute-Force:  A program tries to guess your password over-and-over again.  Until it breaks in.  This method works, but takes forever and needs decent computational power to be effective.  Unless the password is not secure (short).  
2. Dictionary Attack:  A program uses a list of common words to guess your password.  A hacker can input certain words to be used first, e.g. your pet's names.  The program uses these words combined with symbols and numbers to guess your password.  
3. 1. This is why you should never use personally identifying info in your passwords.  It's shocking how fast a dictionary attack can happen when the keywords in your password are : "Patches", "Muffin", "MyNickName"...
4. Social-Engineering:  Someone pretends to be someone with authority to get your staff to disclose a password.  This is the most effective way to date, to steal a password.  Because the biggest security risk at every location, sits between a keyboard and a chair.

How to Mitigate Social-Engineering:

1. Hierarchical or Granular Access:  Don't give someone access to passwords they don't need.  You cannot disclose what you don't know.  
2. Only Allow Secure Sharing:  Don't disclose passwords over the phone, through text, or plain email.  
   Share passwords by:  
3. 1. Sending a password protected Word document via email, 
   2. Use your cloud service's secure sharing (the recipient is emailed a link to a document that can only be downloaded once, and can only be downloaded by the email recipient).
4. Institute a "Verification Protocol":  This is really simple.  If someone calls to get a password or other sensitive info.  Verify who they are first.

Example Verification Process:

Someone calls claiming to be from "Texas Technician" and asks for a password:

• Inform them that you have to verify who they are before you can give that info.
• Ask for some form of personal identifying info: 
• • First and Last name.  (some companies refuse to allow employees to give their last name).
  • Employee ID.
  • Direct Callback Number (help desks will sometimes have direct callback numbers, or extensions).
• Ask for Texas Technician's company phone number.
• Inform the person you will have to call them back to verify who they are.
• Google the phone number to Texas Technician.  
• • If this number is different than the one the caller gave you.  Notify your manager of a possible hack attempt.
  • If it matches the number given to you.  Call the main line and ask to speak to the caller.
  • • If that person doesn't exist.  Notify your manager of a possible hack attempt.

This is not a fool-proof method.  The best option is to refuse sharing passwords with outside sources, period.  Texas Technician will rarely, if ever, ask you to disclose a password.  We do ask customer's to enter their passwords, if needed.  Texas Technician does not store any of your passwords, except the admin passwords required to do our work.