The convenience and flexibility of remote working have been balanced by new IT challenges, such as access management, cybersecurity training, and mixed-use device or BYOD policies.
Changing passwords when necessary is part (but not all) of the solution for remote workers and their employers.
Password management issues for remote workers
Managing dozens of passwords and accounts can be challenging under any circumstances. And now, the average internet user has 240 online accounts that require a password. Plus, remote working has brought some new twists that can compromise password security without the right tools and focus.
Greater risk of hacking
Shifting the workplace to an environment once reserved for personal activities was bound to have some challenges. The sense of complacency found in home offices is chief among them. Passwords that were once securely stored and unique might be left in the open, stored on browsers, or reused often because of a perception that nobody is watching anyway. This magnifies the impact of hacking, phishing, and other cybersecurity threats to home-based workers when:
- A VPN isn’t used (unsecured networks): Home and public WiFi networks are inherently less secure than wired or wireless networks in secure office environments. Using a VPN (virtual private network) addresses this risk by encrypting all data going into or out of a device and routing it through a secure portal.
- Devices are used for business and personal applications: When the same devices are used for personal and work life, it can be difficult to control what apps and websites employees use. Company data can fall into the wrong hands if a mixed-use device is lost or stolen or a personal password is compromised. Clear and concise BYOD policies should be put in place if device mixing is permitted.
- Cloud collaboration: Working from home no longer means working alone. Cloud-based file-sharing and collaboration tools have exploded in popularity, but they create new avenues for compromised data and passwords. Each new tool requires a password of its own, and passwords shared over these open platforms can be vulnerable to cyberattacks because the files and messages exchanged on many collaboration platforms are stored indefinitely.
- Getting locked out of accounts: Lockouts due to lost, forgotten, or expired passwords can become a headache for IT teams. Along with the familiar reset-it-and-forget-it password loops that impact both remote and on-site workers, remote employees are more likely to experience lockouts due to cached credentials on local devices that create password disparities for employees not directly connected to their company networks.
- Onboarding and offboarding remotely: Onboarding employees remotely can be difficult because many introductions, training, and computer setup processes have traditionally been performed in person. Gaining initial access to necessary accounts can be a major pain point for new hires. Offboarding remote employees can be equally challenging since BYOD policies and remote interaction with IT teams make it harder to ensure all business data, devices, and passwords are accounted for when employees leave.
Best practices for changing passwords for remote and hybrid workers
Remote workers might feel like working solo in a home office gives them an edge when it comes to privacy and password security, but that isn’t the case. Establishing password change frequency best practices as part of a global security culture requires the cooperation of all employees, whether home-based, on-site, or hybrid.
How often should passwords be changed?
Despite the mandatory password changes many companies have implemented, there are no set rules for when you should change passwords. Many companies established the 30/60/90-day reset intervals based on risks from weak passwords and password reuse, but 2-factor authentication (2FA) and more robust password safety practices have made these rigid intervals unnecessary.
Frequently changing passwords encourages the use of easy-to-remember (and easy-to-hack) passwords and minor password adjustments that don’t improve security. Additionally, password change mandates can cause employees to resort to saving passwords on browsers, which isn’t safe. Unless you discover your passwords are at risk, it’s not necessary to change them periodically.
Instead of asking how often you should change your password, it’s important to review the circumstances affecting remote workers that should always lead to password resets, including:
- If there’s a data breach: Change any impacted passwords right away if you’ve been notified of or suspect a data breach.
- If you shared a password unsecurely: Sharing passwords with coworkers over email, text, or chat apps can increase your vulnerability if trusted associates are exposed to a cyberattack.
- If you didn't use a VPN in public: Remote workers often log in from public settings like cafés and airports where WiFi can be subject to data intercepts. Passwords should be changed any time these networks are joined without the benefit of a VPN.
- If your information is found on the dark web: You may not realize your password, email address, or phone number has been leaked until it’s too late. Dashlane’s Dark Web Monitoring service alerts subscribers if their information is detected and passwords need to be changed.
- If you have a funny feeling: Most of us can sense when there’s something amiss with our computer or device. Always err on the side of caution when it comes to password protection.
What should I know about the impact of remote work on security culture?
Apart from mandatory password changes and company-sponsored anti-virus software, it’s important for remote workers to remain engaged in the security culture. This can be accomplished through training and policies encouraging remote employees to take responsibility for their own cybersecurity and increasing awareness of common problems like phishing and spoofing.
Dashlane Password Manager provides Password Health scores to give each employee more insight into their individual password strength (or lack thereof) and reinforce the security culture for remote workers. The admin dashboard assists IT teams by indicating which employee accounts are using weak or compromised passwords.
In addition, education and awareness of when to change passwords can enhance security for remote and hybrid workers.
The best way to change your passwords
Once you’ve experienced a data breach or malware attack, used public WiFi without a VPN, or just had a gut feeling about the security or privacy of your passwords, it’s time to make a change. Keep the following tips in mind when you reset passwords.
Replace the old one with a new, strong, and unique one
Simply replacing the old password with a similar one isn’t enough. Make sure your new password is strong and unique by including a mixture of upper and lowercase letters, numbers, and special characters. Use at least 12 characters and avoid common phrases or personal identifiers like your name and address.
Store it in a safe place
Lax password storage is a common issue for remote workers. Instead of writing passwords on sticky notes and leaving them in unlocked drawers or storing them in spreadsheets, find a secure location where your can file your passwords. The best way to store passwords safely is by using a password manager to encrypt and store your passwords on secure, encrypted servers.
Use a password generator
Long and complex passwords can also be difficult to devise and remember. Dashlane’s Password Generator uses advanced algorithms to create long, random, and unique passwords for you. Convenient, user-friendly Autofill takes the guesswork and memorization out of password recall.
Why is it important to change your password?
Along with the when and how, it’s important to understand the reasons why remote workers should change their passwords and keep track of their password health.
- Hacking algorithms take time: A complex and unique password created by a password manager can slow down the brute-force password-breaking tactics intended to decrypt passwords. Extra characters and random patterns can add months, years, or centuries to the expected code-breaking time.
- Data breaches: Longer detection and reporting times for data breaches have been unwanted side effects (with steep financial consequences) of the remote workforce. Home-based workers should report any suspected malware or spyware attacks to their IT teams and use an encrypted portal for password sharing so that information can be shared privately without increasing vulnerability. Dark web monitoring helps remote workers quickly respond to any previously undetected breaches or data compromises.
- Reused passwords: Endless new accounts and passwords can easily lead to more reused passwords. Duplicated passwords can weaken cybersecurity by exposing many accounts if even one password is compromised. With the help of password health scores to track compromised, weak, and reused passwords, ongoing updates can be focused on shrinking the repeat list.
- Unsecured networks (without a VPN): Public WiFi and even home WiFi networks have become a target of choice for hackers, as tactics like fake access points and man-in-the-middle data intercepts have been developed and refined. Sending company data over an unprotected WiFi network can be a recipe for cyber disaster. The additional VPN offered by Dashlane encrypts communications to and from your device, lets you access geo-blocked content, and provides online anonymity by masking your IP address.
Remote workforce credential visibility and provisioning at scale
Remote and distributed teams remove the informal safety nets that an in-office environment provides. There's no colleague noticing a coworker's unlocked screen, no IT staff member walking the floor, and no easy way to physically hand over a device for a security check. Password change policy has to be enforced through tooling, because it cannot be reinforced through physical proximity.
From admin dashboard alerts to a complete credential health picture
The admin dashboard capability already referenced in this article, surfacing which employee accounts have weak or compromised passwords, is the foundation of remote credential security, but it works best as part of a fuller picture:
- Weak and compromised password alerts flag accounts that need immediate attention, based on password strength scoring and matches against known breach data.
- Reuse detection identifies employees using the same password across multiple accounts, a risk that is easy to miss without centralized visibility, since no single account owner can see an employee's full password footprint across the organization.
- Dark web monitoring extends this visibility outward. When an employee's credential appears in a new breach dump anywhere on the internet, the admin dashboard surfaces the alert, giving remote IT teams the same early-warning signal an in-office team would eventually get through other channels.
- Remediation tracking confirms that a flagged employee actually completed the password change, closing the loop on the alert rather than leaving it as an open item the IT team has to manually follow up on. For a remote-first or hybrid organization, this dashboard functions as the replacement for the informal oversight that physical proximity used to provide.
How Dashlane helps remote workers secure their passwords
Like remote working, password managers bring more privacy, flexibility, and convenience to our daily lives. Dashlane Password Manager makes it easier for home-based workers to create strong, random, and unpredictable passwords, then store and autofill them securely.
With standard features like 2FA, Password Health scores, single sign-on (SSO), and a secure password-sharing portal, plus a suite of capabilities that go beyond password management, Dashlane has assembled the ideal password tool kit for remote workers and their employers.
Frequently asked questions
What tools give security teams real-time visibility into employee credential risk for remote teams?
An admin dashboard that surfaces weak, reused, and compromised passwords across all enrolled employees is the core tool, extended by dark web monitoring that alerts the security team when an employee credential appears in breach data anywhere on the internet. For remote teams, this replaces the informal visibility an in-office environment would otherwise provide.
How do I give new remote employees secure credential access from day one?
SCIM provisioning connected to the organization's identity provider automates account creation, including the employee's business password manager access, at the same time their identity provider account is created. Combined with SSO, the new remote hire logs in on day one and has access to the shared credentials their role requires, without receiving a credential over email before their first day.
How do enterprises manage and reduce credential-based security risk in fully remote environments?
Remote environments require tooling to replace what physical office proximity would otherwise provide: an admin dashboard for password health visibility, dark web monitoring for early breach detection, and SCIM-based provisioning and deprovisioning tied to the identity provider so that access changes happen automatically as employees join and leave.
How do I remove a departing remote employee's access if their device is never returned?
SCIM-based deprovisioning revokes the employee's access at the system level: the moment they are removed from the identity provider, their business password manager access and every SSO-connected account they had are cut off, regardless of whether the physical device is ever recovered. This is the primary reason system-level revocation matters more for remote teams than for in-office ones.
What are the biggest credential security risks facing remote and distributed enterprises?
Incomplete offboarding is one of the most significant, because remote teams cannot rely on physically recovering a device or having IT walk through account closure with a departing employee in person. Combined with weak or reused passwords that go undetected without an admin dashboard, and phishing attacks that are harder to catch without the informal oversight of an office environment, remote teams face a version of every credential risk that in-office teams face, without the physical-proximity safety nets that used to catch some of it.
Sign up to receive news and updates about Dashlane
