Safe password sharing: cyber security practices in UKAD

As we know, informational security is extremely important, especially when we talk about any money-related operations. Now, most of all users realize that they should set strong passwords or even utilize 2FA with banking apps. But here come many more cybersecurity issues aiming your business such as unsafe credentials sharing.

Why cybersecurity is important for business?

It's obvious, there are lots of methods to steal your data from keyloggers and brute-forcing to well-planned attacks performed by the huge teams of hackers. In most cases, unauthorized access to secured data leads to crucial damage impacting both the financial part and reputation. That's why there come billions and billions of dollars spent on cybersecurity by big corporations and states. But sometimes they are spent in vain.

As cybersecurity gurus say, the most dangerous weakness is the user. Even utilizing all the progressive practices and software, we can't guarantee that somebody will never do a dumb thing. For example, your credentials won't be shared via the unsafe channel.

Today, there is no guarantee that any listing is safe. Even more, there are too many things demonstrating the unsafety of popular messengers and email providers. So, it's better to take in mind that every message is read by somebody than trust in listing security. At least you won't despair when detecting the leak.

What is the main problem of the unsafe listing?

The most important problem we face during the collaboration between the business and the developer team emerges while credentials are shared. It could be enough to send one email with a password from the hotspot in the office building to provide traitors access to your servers. Of course, it's not a common case but you never know. And seems like you don't want to share any know-how or databases, or so on to the digital villains.

On the other hand, from time to time it's necessary to share credentials. For example, we have to do it when we onboard a new teammate. It's not a great secret: developers commonly share credentials with each other. It's just a part of our work.

What UKAD do to protect you?

Facing a necessity to swoop credentials inside the teams and with our customers, we decided to special software Passbolt for three reasons.

At first, it's really safe. Passbolt utilizes cryptography to store passwords and sends them encrypted over HTTPS. Passwords are protected with OpenPGP while stored on the server and with SSL while sent (eg. from the server to your PC). It means, even if somebody gets access to this data, it will be impossible to use because there are no passwords stored as plain text and no keys for encryption.

The second reason to use Passbolt is its open-source nature. It allows us to use own servers to store encrypted passwords which means better protection of the stored data. As soon as everything is managed only by our DevOps, we are independent of any third party providers. It's obvious that independent security software is far safer than proprietary. And it's also more cost-effective!

And the last one. Passbolt is designed for teams instead of other password managers. It's easy to manage credentials, it's easy to change passwords from time to time, it's easy to provide access. Besides , it's ok to use Passbolt as a personal manager to restore access after backups or just to stop keep in mind numerous passwords.

Summary

Or TL: DR version.

We utilize Passbolt to share and store credentials securely as a part of our outsourcing practices. For our customers, it means that their data is strongly protected by cutting-edge encryption solutions. It's impossible to access any secured data for those who don't belong to the team working on it. For developers here comes easy and fast credentials sharing which may be crucial in some cases and pleasable in the whole development process. And it's also very easy to use!

Author: Alexander Razvalinov

CTO at UKAD