Cybersecurity Starter Kit: Section 4
In this section, you’ll learn to:
Your nonprofit may use dozens of accounts for email, fundraising, finances, communications and program delivery. Remembering a different password for every account is difficult. Managing who can access those accounts adds another challenge.
The aim is to make strong, unique passwords practical while ensuring that organizational access can be maintained when someone is away or leaves
What makes a useful password?
A password should be:
Unique
Used for only one account, including keeping work and personal passwords separate.
Long
Length helps make a password harder to crack, even for technology used by scammers.
Unpredictable
Avoid names, birthdays, your organization’s name, familiar quotations and patterns such as changing only the year.
Reusing a password creates a connection between otherwise separate accounts. If it is exposed through one service, someone may try it on others. Small variations, such as adding a different number, can be predictable too.
For passwords you need to remember, such as the password that unlocks your password manager, a long passphrase made from randomly selected, unrelated words can be useful. For other accounts, a password manager can generate and store long, random passwords.
Do not use passwords or passphrases published as examples in training materials.
What is a password manager?
A password manager creates and stores passwords in a protected digital vault. You unlock the vault to retrieve or fill in the password for an account. Depending on the tool, it may also:
The Canadian Centre for Cyber Security recommends password managers as a way to manage unique passwords and passphrases.
A password manager reduces the need to memorize passwords or send them through email and messages. It also concentrates valuable information in one place, so protecting the vault and planning recovery are essential.
Choose for your organization’s needs
A tool that works well for one person may not meet the needs of a team. Before selecting a password manager, consider how your nonprofit will use it.
Does it work on our devices and browsers?
Staff and volunteers need a practical way to access it during their work.
Can each person have their own login?
Individual access makes permissions and departures easier to manage.
Can we separate personal and organizational credentials?
Organizational access should be manageable without exposing someone’s personal accounts.
Can we share only selected credentials?
People should receive access to what they need for their role.
Can an authorized administrator remove access and manage handover?
Your organization needs continuity when people change roles or leave.
What happens if we change tools?
Check whether credentials can be transferred and how exports are protected.
Is the tool actively maintained, with clear security documentation?
Understand how it protects information and how updates and security issues are handled.
What MFA and recovery options are available?
You need to protect the vault and recover access without relying on one person.
What features are included, and what costs extra?
Team sharing, administration and recovery features may require a paid plan.
Tip
Free tools can be useful, but confirm that their features fit your arrangements. A free personal plan may not provide the sharing or administration a nonprofit needs. Check features before purchasing an upgrade or accepting a bundled product.
What about the password manager in a browser?
Browser and device password managers can help individuals create and store unique passwords. Whether they are appropriate for organizational use depends on their sharing, account ownership and recovery features.
Check which account the passwords sync to. If organizational credentials are saved only in someone’s personal browser account, handover may be difficult.
Also consider who can unlock the device or browser profile. On shared computers, avoid saving organizational passwords in a profile accessible to other users. For public or communal devices, use an approved access arrangement and sign out when finished.
Protect the vault
Treat the password manager as an important account in its own right.
Store recovery information securely and separately from the vault it is needed to unlock. Do not put it in general worksheets or an ordinary shared document.
A password manager does not make a compromised device safe or prevent every phishing attempt. Continue using trusted sign-in routes and verifying unusual requests.
Share access carefully
Where a service supports individual accounts or delegated access, use those features first. For example, a communications volunteer may be able to manage social media through their own authorized login rather than using another person’s password.
When a shared account is necessary:
Removing someone from a shared vault does not erase a password they previously viewed or copied. Change shared credentials they knew when their authorization ends, and review other routes to access, including registered authenticators and active sessions.
Practice with one account first
Introduce the tool gradually so people can learn the process.
01/
Choose an approved password manager and establish vault protection and recovery.
04/
Confirm access from any other approved device the person needs.
02/
Practice saving and retrieving a password for a lower-impact organizational account.
05/
Move on to priority accounts from your inventory.
03/
Generate a unique password and confirm that the account works with it.
If importing existing passwords, remember that imports and exports may create unencrypted files. Follow the tool’s instructions, restrict access to those files and remove temporary copies after confirming the transfer.
When should passwords be changed?
Change a password when it is known or suspected to be compromised, accidentally disclosed, or reused on an account affected by a breach. Replace default passwords and change shared passwords when someone who knew them no longer has authorized access.
Routine changes simply because a set number of days has passed are generally not recommended. They can encourage predictable variations. NIST guidance calls for changes when there is evidence of compromise rather than routine periodic expiry. Follow any applicable requirements your organization must meet.
If an account may already be compromised, changing its password is only part of the response. Report the concern and check access, recovery settings and signed-in sessions through your organization’s response process.
A suggested policy rule
Organizational accounts must use unique passwords. Credentials must be stored and, where necessary, shared through an approved method. Individual or delegated access must be used where supported. Access and recovery arrangements must be reviewed when people change roles or leave. Suspected exposure must be reported promptly.
Before adopting this rule, identify the approved storage and sharing method, who manages it and where people can get help.
Review how you manage passwords
Look for reused passwords, credentials kept only by one person, passwords shared through messages, and organizational credentials stored in personal accounts.
Record arrangements and gaps, not the passwords themselves!
Your takeaway
By the end of this section, you should have:
- An approved approach to storing and sharing organizational passwords.
- A plan to replace reused passwords with unique ones.
- Protection and recovery arrangements for your password manager.
- A process for maintaining access and removing authorization when people leave.
Next, you will explore the built-in protections that help secure your nonprofit’s devices and how to manage who can access its information and services.
Section 5: Keep devices and access secure
Protecting your nonprofit’s devices starts with understanding built-in security features, why they matter, and who is responsible for ensuring they are enabled and maintained.
English 
French 
Chinese 
Spanish 
Ukrainian 