WebYadaYada

The list of passwords for all the different technology around even a 1 person office is daunting.  You definitely need to track all these user names and passwords. you should also be able to identify the company and a contact for each.  Of course, there may be more.  Some companies will require the last for of a credit card, so you might want to track that too.

• Domain Name
• DNS Servers
• Email Administration
• You website if it is editable
• Analytics
• Data Backup
• ISP
• Phone System
• Computers
• WiFi
• Router
• Banking
• Payment Processing like Paypal
• Virtual Terminal for Credit Cards
• Accounting Package

Managing All These Accounts

Where possible you should always set up a master account using one of your main passwords and for each user in the company (including yourself) create a separate account with unique passwords. Save the master passwords for your innermost circle and let the day to day operations be handled by your staff through their own accounts.  That way if you have to let someone go, you can delete their account without having a major security risk.

My recommendation is to use 4 passwords and to write them down in a secure location. DO NOT PASS THESE PASSWORDS OUT TO JUST ANYONE, INCLUDING YOUR EMPLOYEES!

• Ultra Secure- only the owners and accounts of the business should know this password.  These are for things like banking passwords, accounting software, off site data backup, etc.  If you have an employee who needs access, you should create a new account for them and set them up with their own user name/password.  This sis available for most modern systems.
• Office Infrastructure- This password can be used for things like your Phone System, Internet Service Provider, and network passwords.  Generally, these can be given to various employees as the damage that can be done is generally short term only.  I only use this password with companies I really trust like ATT, Google, etc. (Of course, trust is a funny word here, but I have reasonable confidence these company’s value my security.)
• General Password- for everything else, such as a stock photo gallery website or a vendor website, you can use this single password and pass it around to who ever might need it.  This password can go to any other company’s website you are comfortable with.
• Throw Away Password- for all other sites, I have a specific password that I use that I know may be discovered and exploited. There a number of sites that require you to sign up for an account just to get to certain content.  Use this throw away password for those sites.

So what makes a good password?

• 8 characters is a minimum
• You’ll want to use numbers and letters combined for better security.
• For your Ultra Secure password, create one that has both an Upper and lower case characters and a number.  Don’t use a symbol in this password.  For whatever reason, a number of big financial sites, like Chase.com, don’t accept symbols (which would be more secure.)
• Try not to use and entire word.  “WebSites1″ is not a good password, neither is using numbers to replace vowels: “W3bs1t3s1″  Many programs use a dictionary and try variations on a word to guess your password.
• Don’t use typical numbers from your life.  Your birth day, year you graduated, etc can generally be discovered and used against you.  Even mixing up the numbers like the day I was born plus my wife’s year she was born plus my graduating year tend to make combination that will be tried.
• Mnomics are good to help remember and not too obvious.  A friend I have uses the first letters from nursery rhymes with some capitals and numbers to create a 14+ character  password that is easy to remember and hard to crack.

Where Do I Store My Passwords?

Keep Pass (http://portableapps.com/apps/utilities/keepass_portable) is a great little password organizer that encrypts your passwords behind a “master” key.  Since it is portable, you can put it on a USB drive and then store the drive on a shelf or other such place.

An encrypted Word Document or Excel file also offers a good amount of protection.

When Should I Change Passwords?

First, note that when you change passwords you will need to change ALL your accounts associated with those passwords.  This can end up taking the better part of 2 hours (I know since I just did it) so be prepared.

I recommend changing your passwords twice a year.  Also, anytime you part ways with someone who knew the password set, I would change them (before they leave if possible.)