Single Sign-On: Easily Managing Passwords
Managing the plethora of passwords that agency staff have to maintain continues to be challenging. I last wrote about password management options in 2009. Based on the number of questions I am receiving about managing passwords, I decided it was time to revisit the topic.
Password Management Options
There are a number of options available to an agency of any size to help staff secure and manage password information.
Transformation Station is a service provided by Applied Systems to their users (as well as a few other vendors that have licensed this service) that helps manage and store password information within the agency management system.
TransactNow is a service provided by Vertafore to their users that helps manage and store password information within the agency management system platforms.
A few other agency management system vendors have their own versions of password management built into their systems.
These systems, when set up correctly, provide an easy way for agency staff to access a carrier’s agency portal website by storing the website address, as well as the user ID and password. Access to the carrier site is then simply a click away.
If the insurance companies you represent support either of these real-time processes then you should absolutely make sure your agency is using this functionality.
You can receive a customized report from IVANS on the capability available to your agency by requesting a Personalized Agency Download Report. This will help you identify download connections that are inactive or not turned on at your agency.
What I Use
While the services are a great way to streamline password management, they are not a universal solution. As you well know, your agency maintains passwords for many other websites that you and your staff need to access. For management of these user ID and passwords, I recommend a password management software program. There are quite a few programs available.
I use RoboForm as my password management program.
This program installs as part of your web browser (it supports all browsers) and manages login and passwords for you. When you log into a website, RoboForm offers to save the login information into a Passcard. This card is kept in a fully encrypted file that requires a master password to access.
Once the login information is safe, true one-click login is available by clicking on the website name in the Passcard list. The program automatically navigates to the website’s login page, fills the stored login information into the form, and clicks the submit button for you.
RoboForm is available as an individual standalone program as well as an enterprise version that provides additional administrator capabilities for larger organizations. One agency with over 300 users uses the RoboForm Enterprise version to allow all users to manage passwords.
Another option I’ve been testing is LastPass. It provides similar functionality to RoboForm but may have a few features that are valuable. For example, LastPass allows you to provide access to a third-party (a virtual assistant in my case) but doesn’t allow them to see or change the passwords.
There are many reasons to make sure your agencies are managing passwords well. If you currently don’t have a password management process in place, then the above services are a good place to start your research.
How is your agency managing passwords for all users? Let me know in the comments below.
We just started using LastPass and like it. There is a glitch with internet explorer that our IT is working out, but other than that is has been a big time saver. A secondary concern from these password managers is that if you leave your PC or laptop unattended, anyone could hop on and have access to all our private data because LastPass would automatically log them in. So we set up a default on our PC’s that the system will lock if the PC is inactive for 30 minutes. Thanks.
Darrick, it seems with any process you create there are potential problems. As you described, setting the default so that the PC locks after a specific time is one way to require the master password being used again to access the system.
Steve, I am a very few others are using a Password-protected Word document or Excel spreadsheet that is saved to our desktop. It’s easy access, but secure – if one locks one’s workstation when leaving it. However, sadly, most people within this organization have printed that document and leave it on their desk or have other hand-written notes (that would scare the socks off of you!) on their desk that contain their passwords. Read: No security. Thanks for these TechTips!
Marty, using Word and Excel documents to store your passwords is a common practice. Even if you use the password-protected option it’s an extra step that often people forget to do. And, as you said, people will tend to print them out because it’s easier. The path of least resistance certainly seems to always win. That’s why I do like a password management program like I described. Much easier to use.
Hi Steve
I have had success using Dashlane password management.
It syncs on multiple devices. I also store credit card and checking account info on it. This makes prefilling internet purchases painless and quick. I can also share password with 3rd parties. It advises me of unsecure passwords that I have created ( chuck 123) and suggests new passwords when setting up new accounts ( Agld#&k45T). Lastly it has an auto password reset feature which is great when passwords expire. Like all software it has its quirks. I hear Vertafore Agency Platform is going to have true password management that lets supervisors automatically give out passwords to staff to log into insurer sites WITHOUT the CSR’s knowing their passwords!
Chuck, I have not heard about Dashlane as an option. Thanks for sharing this information.
Steve – we’ve also been testing LastPass and looks like it’s a winner!
If you have time, come back and leave a comment on the results of your testing. It’s sometimes hard to change from a platform I’ve been using for so long, but LastPass does look very interesting.
We’ve been using RoboForm (RoboForm Everywhere) for over 10 years. In addition to the features you mentioned, the data file is cloud-based so a user can access his/her logins from any computer anywhere simply by logging into the RoboForm site. It also includes an easy to use iPhone app.
Scott, I also use the RoboForm Everywhere and it works great for sharing password information across multiple devices.
we use robo-form as well. its ok, not great, often wants to re-save the same passwords for websites then creates http://www.blahblah1 http://www.blahblah2 http://www.blah blah3,, etc.
Wendi, one option you can use is to overwrite an existing card when a password changes and/or the website address changes. This will prevent the program from creating multiple password cards for a specific website.
I’ve been using LastPass for several years with great results. I manage 778 passwords in my paid account for $1 / month including the Android access and ten people on my office staff share a ‘free’ account with 225 passwords. With the paid account I can push passwords down, allow them to change most of them, and receive notifications and updates as various carriers require changes. I’ve also shared one-time or continuous access to secure sites with friends, family, or vendors (for instance sharing access to update website publication with our local vendor). There are a few minor issues from time-to-time with websites that don’t use standard coding, but always good copy/paste workarounds.
I’ve been using LastPass for a few years. It is not perfect but it works! Has mobile applications as well and works across all my platforms at home and at work.
We use Transact Now and we have been using the free version of LastPass for about a year, basically it works very well for our agency. I would recommend it .
we use e-services in Nexsure as well as keypass
Jay, as I mentioned in the article there are a number of vendors that have created their own processes. Anything you can use to help streamline the management of sensitive information is a good thing.