1

I would like to automate the recovery of the password for the employees of a company. However, the problem is that not every employee has a corporate email account and some employees can't access their corporate email, if they have forgotten their password.

Is it best practice to send a password recovery link for a company application to an employees personal email address?

Is there another method to automate the recovery of a password in this scenario?

Improve this question
8
  • 2
    If they are in the workplace I would suggest using physical verification to reset the password - some trusted employee (manager, etc) will authenticate the employee (by ID, etc) and then allow them to set a new password. As for using a personal e-mail address I don't think it's a good idea as the personal email may not be as secure as the company's email il (especially if the company infrastructure has passed some certification, in that case you may run into big legal trouble as the personal email address doesn't have such certification).
    – André Borie
    Commented Jun 4, 2016 at 13:29
  • Where are you getting the personal email from? Are they just entering it on the password recovery form, or is it part of the company's records for each employee?
    – Neil Smithline
    Commented Jun 4, 2016 at 14:31
  • @NeilSmithline the personal email is part of the company's records for each employee
    – Eloy Roldán Paredes
    Commented Jun 6, 2016 at 9:28
  • 2
    Just do what @AndréBorie says. Sending passwords resets (or any other corporate information) to employee's personal emails is just stupid. Doubly stupid if the company in question operates in a regulated industry.
    – Little Code
    Commented Jun 6, 2016 at 22:15
  • @AndréBorie Physical verification is not possible as we are more than 50.000 employees distributed geographically.
    – Eloy Roldán Paredes
    Commented Jun 7, 2016 at 5:43

3 Answers 3

Reset to default
3

The problem with relying on personal email accounts is that you don't have any control over how well those are managed. How many of your employees have "abc123" as the password for their email account? Do you want to rely on that for the security of your corporate email?

A better option would be to allow managers to reset the passwords for their employees. Most people won't have the phone number of IT handy but they probably have their boss's number.

Let the manager set a new password and then require the employee change it on first login.

This also helps solve the identification problem. I doubt your IT team would be able to verify all employees by voice or sight but a manager is going to recognize the people they manage every day.

Improve this answer
0
1

Password recovery is hard to keep completely secure via email and it sounds like a personal account is the only option available to you. as @andré-borie mentioned in the comments above, a physical verification and showing a picture ID is the most secure method but is not always possible for remote workers.

There are some things you can do to make the reset process more secure:

  • Only allow resets from company IP addresses
  • Prompt for a secret question, company ID number, etc.
  • Log all attempts to reset passwords
  • Send a notification to the user's mobile phone about the reset request
  • After the reset, send an email or mobile notification that the reset was completed
Improve this answer
1

Basic security tips:

1) Ask 3 secret questions. Usually, the self-defined secret questions are weak, so the company should predefine them and let the user choose from a list of questions.

2) Log the password reset attempts, and make steps to prevent brute force methods to work. You should lock automatically his/her account after a few unsuccessful tries.

3) Send email notification to the user after the reset.

Advanced security tips:

4) Use one time passwords for more security. There are good, secure mobile applications for this.

5) Limit the access to that application only from corporate network. If the employee works from home, force him to use corporate vpn.

6) Aslo send notification to his/her manager after a successful reset.

Improve this answer
2
  • 3 security questions seems to much for me
    – Eloy Roldán Paredes
    Commented Jun 7, 2016 at 14:19
  • @EloyRoldánParedes, you don't have to use the recovery function often, so it's not that big burden. And for the attackers, it's much harder and conspicuous to get the answers for all the three questions than just one.
    – BlackCat
    Commented Jun 7, 2016 at 15:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .