Guest Expert Blog: “How Do You Take Care of Your Passwords? - by Tommy Boucher

I’ve been working in IT for more than 10 years. I started with doing some cheap web hosting, and now I’m the IT Director of a fast-growing technology company, and managing more and more servers every day.

In the distant past, I’ll admit that I used the same password for all my systems – until one day, a blog that I had subscribed to was hacked, and all of the passwords were leaked. Since then, I’ve taken password security a lot more seriously!

**Spreadsheets: Just Say No! **

Back then, password managers weren’t popular, and so my first idea was to create a “protected” Excel file for all of my passwords. However, soon after that, a friend contacted me and asked for my help. He had also created a protected Excel spreadsheet, and had forgotten his password. I Googled for a couple of minutes and, as you may imagine, I found a way to access his (so-called) protected spreadsheet. And guess what? The same hack worked on my protected spreadsheet, too! When realized it was time for something better, I discovered KeePass.

**KeePass: Looked Good, but Didn’t Deliver **

Initially, I was impressed. KeePass seemed to be very secure software, and capable of storing all of my passwords with a very complex master key. I also liked the auto-fill feature, which would allow me to save time entering my username and password every time I logged onto a server.

But I started facing problems right away, because each username and password was different for each server, and there were issues getting Keepass to auto-fill the correct password for the correct RDP session. It was also frustrating when I clicked in the wrong place, and my password would populate the username box. It was also a major challenge to keep the password database synched between all computers, and regularly backed up. My team was growing, and I had to share passwords from time to time – except that many of them were no longer valid, and colleagues would ask, “Hey, who changed the password for this server? The one I have in my KeePass doesn’t work anymore.”

Looking for a Better Solution

We obviously needed a better solution. To help us evaluate possible tools, we built a very complex spreadsheet with all the features, pricing and options, and compared it against our needs. For example, we needed a solution that would work for Windows and Mac, and we wanted to access enhanced features, such as synchronization with Active Directory, a powerful administration console, the ability to manage users and groups, and so on. We also needed an import feature, because many of my team members were using their own tools, and we wanted to merge them into one centralized solution. Our shortlist was made up of 5 solutions: LastPass**, Password Vault Manager, DashLane, **Enpass.io, and KeePass.

And the Winner Is…

After evaluating each solution, I decided that Password Vault Manager was the clear winner for my team. We liked that it allowed us to use our own database (on-premise or cloud), which gave us full control over our security – and ensured that unauthorized users couldn’t access our database. Other things we liked include:

• Windows integrated authentication, which uses inherited permissions (e.g. password policy, account lock, etc.)
• The ability to create groups, roles and folders, and share them as necessary
• A very structured interface and an easy-to-manage console
• The option to add almost any kind of secure entry, including Service Account, and link entries to RDP sessions (or copy username/copy password). No more writing passwords in the wrong input box!
• The ability to import credentials from almost any source, fill web pages, and more.

And the MOST important reason:

• Integration with Remote Desktop Manager, which we had been using for some time and were very impressed with (RDM shares an SQL database with my team).

Basically, my view, also shared by my team, is that Password Vault Manager is **powerful **and **enjoyable **to work with. The console is clean, and not just designed to manage web pages. The only thing we would like to see changed is that currently we need to run the process on our computer, so that the web browser add-ons can communicate with the database. However, this is not a deal breaker for us.

So, how do you take care of your passwords? We use Password Vault Manager and have never looked back!