Skip to content

Home / 🟠 AREAS / ICT / Password security

Password security

Every password lives in the password manager, every account has two-factor sign-in, and no secret is ever written in a message, a document or a repository.

Rules

  1. One password per account, generated by the password manager.
  2. Two-factor sign-in wherever an account offers it; a passkey where possible.
  3. Shared access goes through a shared vault, never through a password sent by email or chat.
  4. No secret in a repository or on a page of this playbook.
  5. When someone leaves, their accounts are closed on their last day and the shared secrets they knew are changed.

When something leaks

Change the password at once, check the account's recent activity, and tell the person responsible for ICT.