0

Sometimes we cannot avoid to write down usernames and passwords internally in our organisation. This is mainly for personal usage, not for reading by programs.

There are several ways to do this, e.g.

  • username/password
  • username, password
  • "username","password"

All of them and more are used in the field. What is the "best" way to do this we can recommend internally in our organisation? Are there pros/cons for each alternative or should we leave users create their own style?

Improve this question
3
  • This is going to be primarily opinion based because there is no security standard when it comes down to writing down credentials: Best practice is to not write them down at all. To give some advise though: When you do write credentials down, fold the paper so you cannot see the credentials (when looking through windows, for example).
    – Kevin
    Nov 26, 2018 at 16:37
  • Thanks, how to handle the sheet when everything is written down is one thing (folding, covering,...). The other is how to write down.
    – WeSee
    Nov 26, 2018 at 16:39
  • "Best" in what way? Best for what? How would the punctuation used make a difference?
    – schroeder ♦
    Nov 26, 2018 at 20:20

2 Answers 2

Reset to default
1

There is no best practice for writing down passwords (or credentials in general). This mostly depends on your own company and how you decide to write them down, I don't see any reason to have rules in place for standardized credential writing. The advise in general is to not write down credentials at all. If you must write down credentials, there are a couple steps you can take to improve security.

  • Use two factor authentication so that if credentials are leaked, your accounts are still somewhat secure;
  • Make sure to have a standard when it comes down to writing down credentials and the disposal of papers with credentials on it. You can for example have a standard paper for writing down credentials and a special bin to remove then;
  • Fold paper with credentials on them so other people cannot as easily read them by looking at them from a distance.

One of your main problems will be a violation of 'clean desk policy' which you can look and why it is important and things like bin diving.

Improve this answer
0

To me, it seems the best, simplest, and most standard solution here would be to use a centralized, secure password manager. Is there some reason not to?

I should add the caveat, though, that the truly “best” solution can only be determined through knowledge of your organization. Every organization’s particularities define what works for it, so it’s important to optimize for your own org.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .