Example: Users want to use Sticky Notes for quick note taking. They don't like other options, they want Sticky Notes.

However, Sticky Notes normally stores the information in a SQL db that can be read with Notepad++ with little trouble.

Telling users not to store passwords on there is all well and good, but they will still do it and even if we punish them, they still put the company at risk.

Can you secure Sticky Notes such that they can't be simply read with an editor?

  • You said they don't like other options, do you know why? Have you tried training them how to use a real password manager? – AndrolGenhald Feb 27 '19 at 21:09
  • I can't believe I'm suggesting this...there are 3rd party sticky notes applications which allow use of password protected "secure" sticky notes...but really please use a combination of training and policy (with enforcement...only takes a few examples) to change user behavior towards a password manager. – DarkMatter Feb 27 '19 at 21:22
  • Even if this is not related to your question, try to raise their awareness instead of punishing them :) – Soufiane Tahiri Feb 28 '19 at 9:02
  • @AndrolGenhald It has to do with how users secure these password safes. Part of managements worry is that if someone leaves the company or even takes PTO and is without contact, we won't be able to retrieve passwords they control. We have put forward options that have both admin passwords and user passwords, but it's a slow uphill battle. Even if we do get a password safe approved, users still want to use sticky notes for quick note taking - which would also let them still store passwords on there. Ideally there would be a middle ground protecting against this. – Crumblez Feb 28 '19 at 14:11
  • @SoufianeTahiri Yes, training and awareness would be the first goto steps. We leave a certain amount of this up to managers and some are worse than others. – Crumblez Feb 28 '19 at 14:12

It depends.

Full disk encryption will protect the sticky notes (and everything else on your hard drive) when the computer is turned off. However, it will not protect you from someone taking a peak while you are on a coffee break. If that is a requirement, you'll have to get them to use something else.

What your users really want is probably not sticky note. What they want is convenience. You will have to find another solution that is even more convenient, and take some time to teach them how to use it. For instance, a password manager could autofill the passwords for your users, so you don't even have to do the copy paste!

But convincing people to change habits is hard, so don't expect it to be easy.

  • Another issue that I forgot to add in is the environment is on virtual infrastructure. We lock down cross communication between virtual desktops, and have a screen timeout of 10 minutes, but there are still far too many screens left unlocked when I walk around and see empty desks. A middle ground might be encouraging OneNote since that's a more secure option that we have access too and only a few users use. I definitely want to roll out a password manager for them, cut out the excel spreadsheets of passwords that some people have. But it's an uphill battle with management. – Crumblez Feb 28 '19 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.