Passwords & Authentication

Most systems authenticate users with a username and password combination. Passwords are secrets, and they must be managed with care so they do not create security risks. This page explains how we approach passwords and authentication at Risely.

Our approach

Passwords are shared secrets and, as such, are inherently vulnerable. Authentication methods that rely on shared secrets are less secure than ones that do not. Our strategy is to minimize the use of passwords wherever possible:

• We use a single sign-on (SSO) mechanism to authenticate wherever possible. This avoids the need to create new strong passwords, and we ensure the SSO authentication mechanism is secure.
• We use multi-factor authentication (MFA) wherever possible. This reduces reliance on passwords and adds a barrier even if a password is compromised.

Passwords remain the most common way to authenticate, and there are scenarios where the options above cannot be applied. In those cases, we follow the guidelines below.

Password generation and strength

• Complex passwords are used wherever possible for accounts that have access to critical data. Strong passwords are unique and randomly generated, ideally by a password manager. Two-factor authentication (2FA) is enforced on all company Google accounts.
• Complex passwords can be achieved either by generating them with a password manager (recommended) or by using a passphrase of five or more dictionary words, which can be easier to remember while remaining equally hard to guess by brute force.
• We strongly advise against reusing passwords that are or were used elsewhere, such as personal accounts. A common way attackers obtain access to corporate resources is by using personal passwords exposed in breaches of other services.
• To avoid creating and maintaining a large number of complex passwords, we use “Login with Google Workspace” or another approved OAuth provider wherever feasible.
• Multi-factor authentication is enabled wherever it is available. For critical services, multi-factor authentication is mandatory.

Questions

If you have any questions about this policy, contact us at [email protected].