A password policy is easy to write and harder to live with. People still need to sign in, cover for a colleague, and keep work moving. When the approved process is awkward, passwords find their way into messages, spreadsheets, and memory. RIKR uses a managed 1Password account in our cybersecurity offering to make a better process part of everyday work.
What does a password safe actually do?
A password safe, vault, or manager stores credentials in an encrypted repository and helps people generate and use strong, unique passwords. A business implementation also needs a plan for access, recovery, and collaboration. The useful question is not just where the passwords live. It is who can use them and what happens when responsibilities change.
Long, unique passwords become more practical when employees do not have to memorize each one. A vault can support a sensible policy, but it does not change the rules of every website automatically. Your IT team still needs to configure account requirements, authentication, and access in the systems themselves.
Source: NIST: Digital Identity Guidelines FAQ on password managers
Why 1Password fits the RIKR approach.
We want security tools that people can use in the flow of their work and that we can help administer consistently. With 1Password, shared vaults and group-based permissions provide a way to organize business credentials around the teams that need them. Watchtower helps surface issues such as weak or reused passwords so cleanup can become an actionable task.
In its account-password security model, 1Password combines an account password with a Secret Key to protect vault data. That is a useful design distinction, not a promise of immunity from compromise. Recovery arrangements, endpoint security, and user behavior still matter; teams using other sign-in configurations should review the protections that apply to their setup.
Source: 1Password: Custom groups and vault access
Source: 1Password: Watchtower privacy and checks
Source: 1Password: About your Secret Key
We chose it for the way we support your team.
RIKR chose 1Password over other available options because its approach fits the service we want to deliver: security people can use, access organized around real responsibilities, and a platform we can help manage consistently. Our recommendation is grounded in that fit for our clients and our service approach.
For RIKR, the value is the combination of the tool and a repeatable process: decide what belongs in the business vault, give the right people access, explain how to use it, and revisit that access when the team changes. Features and plan entitlements can change, so we confirm the required capabilities during setup.
Collaboration should not mean one login for everyone.
Use individual accounts, delegated access, or single sign-on where the application supports them. When a genuinely shared credential is unavoidable, a controlled vault is preferable to repeatedly pasting it into chat. Organize access by role and give people only what they need. The UK’s National Cyber Security Centre treats enterprise password managers as a way to reduce sharing risks, while favoring alternatives to shared passwords where possible.
Source: NCSC: Password manager buyers guide
Make offboarding and recovery part of the policy.
Removing someone from a vault cannot make them forget a password they already saw or erase a copy they made. Offboarding should include reviewing their access and changing shared credentials they could use. 1Password’s own guidance includes password changes as well as suspending and removing the team member.
Source: 1Password: Offboard a team member
Avoid making routine password changes the entire policy. NIST’s current guidance for password verifiers rejects arbitrary periodic resets and calls for changes when compromise is evident. That does not remove the need to change exposed or formerly shared credentials. Your requirements and application controls still need to be considered.
Source: NIST SP 800-63B-4: Password requirements
RIKR helps make stronger password practices usable: a managed vault, clearer access, and guidance your team can follow. If passwords are scattered across your business, let’s talk about your team, goals and needs.
Explore RIKR managed cybersecurity
Written by Joshua Price
Back to the blog