A small step to help the planet — and improve your org’s security

April 21st, 2017   |     |  smarter identity, product & technology

Here in San Francisco, eco-friendly business practices are pretty commonplace. Like many offices in the area, OneLogin has gone almost completely totally paperless- relying on apps like G-Suite and Docusign to handle documents. But there’s one stubborn bit of waste that is hard for many orgs to get rid of: Sticky notes.

Believe it or not, billion dollars worth of these things are sold every year, many of which wind up in landfill. To their credit, 3M (the owner of Post-It notes), is involved in a number of sustainability programs and offer products made with post-consumer recycled content.

But from a security perspective, we are still concerned about the use of sticky notes in the workplace. Many office spaces are littered with sticky notes with usernames and passwords written on them. You can find them on the sides and bottoms of computer screens, in desk drawers, or even hidden beneath mouse pads and keyboards.

Look familiar?

Why this is a problem

Even the toughest password is useless if it’s left out for anyone to see. End users may not think that there is any harm in writing passwords down where their coworkers might see them- you’re all on the same team after all.

But what users don’t always consider is who else might see these passwords. Think of office workers who clean the workplace after hours, or guests visiting your office. It’s incredibly easy for people outside of your org to uncover login information if it’s just sitting on your desk.

How do you think your customers would feel if during a tour of your office they were able to see the login credentials just laying about on employee desks? Especially if they are trusting your org with particularly sensitive information. Think HR, finances, medicine, etc.

A weak password on full display.

The point is that any number of situations can occur where sensitive data is compromised because login details were left out in broad daylight. So how can your org eliminate this security and compliance abomination?

Single Sign-On

One obvious solution is to implement single sign-on for end users. OneLogin Application Portal has over 5,000 pre-integrated apps, including essentials like Office 365 and G Suite. As an administrator, you can assign the right apps to the right departments and individual users within your organization. End users can gain instant access to their complete personal app catalog with a single login, eliminating the need for them to write multiple down to remember them.

The OneLogin Application Portal: One-click access to all the apps you need.

Pair this with the latest in multi-factor authentication, and your users are equipped with an easy and secure way of getting their work done.

OneLogin Secure Notes

We do not typically recommend the sharing of login credentials, but do recognize that it is sometimes unavoidable. If you must share login information with coworkers, we recommend doing so through OneLogin Secure Notes. This feature allows for the secure sharing of notes between users in your organization- all directly from your OneLogin app portal.

Access Secure notes from the top right corner of the OneLogin app portal.

The other day I signed up for a new marketing service that requires me to share credentials with some of my team members. To share these with my team, I can simply create a new Secure Note, and share it with the right people without fear of it falling into the wrong hands. The new Secure Note automatically appears in their OneLogin app portal.

The “New Note” input screen within OneLogin Secure notes.

Revoking Note Access

It’s also important to revoke access to Secure Notes as employees leave your company. The median employee tenure at a company is four years. So, a company maintaining a current size will turn over 25% of its organization each year. Yet one out of 10 former employees can still access to company data after leaving. Thankfully, both of the above solutions take this into consideration.

With OneLogin, IT can easily revoke access to Secure Notes (and company apps) with a single click when an employee leaves. If your OneLogin Cloud Directory is connected to your HR system, such as Workday, UltiPro, or Namely, this deprovisioning happens automatically as soon as HR marks an employee inactive. If you’ve connected OneLogin to Active Directory, our realtime AD Sync deprovisions access to notes as soon as an employee is marked as inactive in AD.

Each of these easy steps help preserve our planet, even if just in a small way. But when combined with robust security and compliance policies, they can play a big role in making your organization more productive and secure.

If you’d like to learn more about how OneLogin IDentity Management and Secure Notes can help your organization, please contact us.

About the Author

Jack Shepherd joined the OneLogin team in Summer of 2015, and is now the Content Marketing Lead at OneLogin. Jack specializes in producing thought leadership pieces around the latest cloud technologies, cybersecurity, and the evolving role of unified access management.

View all posts by Jack Shepherd

Secure All Your Apps, Users, and Devices