Password Management Best Practices

Table of Contents

Why security?

Each organization has unique security needs, so it is vital that your user team analyzes their situation and makes decisions on how to set up their distinct security goals.

Please take the time to go through our suggested best practices, and let our Customer Support Team know if you would like any consultation on them.

General best practices

• Don’t share passwords.
• Don’t use generic passwords or shared operator accounts. Each user should have their own unique username and password.
• Consider using a secure password management program to avoid forgetting your login info, and to avoid having your password in obvious places (like a post-it note on your desk).
• Keep your operating system and browsers up-to-date.
• ALWAYS add a valid and current email to an operator user record so that the operator can recover their password if needed. 
• Make sure to whitelist noreply@keepntrack.com, which is the email address any password reset emails will come from. This might need to be done by a district or facility IT team.
• Have a plan to access the system admin’s password/email if they leave, or have a backup system admin user. 

---

Login redundancies

• We recommend having two distinct highest level operators (System Administrator) for redundancies, in case one operator leaves, then the second operator can still access all areas of the program. For example, this could be someone like a high-level admin, or a District Tech.
• Consider giving a backup, full-admin rights login to a person who is always onsite, like your principle IT technician. Even if they don’t use KeepnTrack regularly, if you ever get locked out, someone can help. This can also be useful if someone is helping out as a kiosk operator temporarily, but the permanent staff is unavailable to help give them temporary access. 
• A lot of this may depend on the size of your facility, and your administrative group should make a plan and policy for password and user management.

---

Creating a secure password

We recommend that you set a standard for secure passwords and train your team accordingly.

Here are some generally accepted password rules:

• It is not safe to use the same password on more than one site. If your password is hacked for one site, then it could be used to get into multiple sites. Reusing passwords is not secure. 
• Create a password that is hard to guess, and doesn’t contain personal information like your birthdate or phone number. A strong password should be easy for you to remember, but hard for anyone to guess or associate with you. Avoid using simple phrases, words, or patterns that are easy to guess. 
• Remember that the longer a password is, the harder it is to hack.
• Follow these simple steps to keep your data (and yourself) safe. 

---

Creating a new secure operator

Adding operators is usually done by an admin, or someone who has greater security rights than the new operator being created. 

Be sure the operator has an EMAIL, maybe even TWO, so they can always recover their password!

Here are the steps to creating a new operator:

1. Go to Users and create a new user. Give them a name and any other basic information.
2. Enter their email in the Contact tab.
3. Under the Security > Access tab, set their username. You can also give them a starting password but it’s not required.
4. Set their Security Group. This determines the level of access to KeepnTrack they have. Review Security.
5. System Administrators have access to all sites by default. For any other security group, you will need to choose the exact sites they have access to.
6. Save the record.
7. At this point, you can let the new operator know that they can log in. You’ll need to tell them their username, and their email or barcode from their record. The operator should then go to log in, choose ‘forgot password’, fill out their email or barcode, and reset their password using the link in the resulting email.

---

Recovering an operator login

There are two possible scenarios for recovering a login or getting back into KeepnTrack; if you have an operator record with an email attached to it, or if you do not. We will cover both below.

If you have access to the operator’s email address or barcode for password recovery: 

When setting up an operator, ensure an email is entered. If an email was entered at the time of setup, the quickest way to recover an operator login is to: 

Make sure to whitelist noreply@keepntrack.com.

If the operator DOES NOT have an email attached to their record in KeepnTrack: 

The steps for recovering a login in this case can be a lengthy process and customers will be required to speak with the COMPanion Support team and confirm their identity and role. Due to security considerations and requirements, COMPanion Corporation and the COMPanion Support Team withhold the right to deny or approve password requests at any time.

If approved, a Support Team member will then issue a temporary password that is good for 24 hours.

With this temporary password, you can log in to KeepnTrack and follow these steps to reset the password:

Go to Users and locate the user profile with the login credentials and permissions. Once the user record is displayed, click the Lock icon to unlock the record. Go to the Security > Access tab and enter a new password, then click Save. 

Please also be aware that our 24 hour temporary password does give the logged-in-user highest access to the program. It is wise to be sensitive with whom you are sharing these temporary credentials.

---

Retiring operators

If you have staff who is retiring, or one that has already left, you will want to remove their access to KeepnTrack. You might also be adding a new operator to your KeepnTrack. Here are the steps to do that.

To remove an operator: 

Go to Users and locate the record of the person who is leaving.  Unlock the record and go to the actions menu and choose Remove User, then select Yes, Remove. 

To create a new staff record, see the section above for creating a new secure operator.

Cleaning up operators

COMPanion suggests regular audits of who has operator access to KeepnTrack, and if old operators should be removed. There are multiple security group levels; all may need to be cleaned up.

To clean up your operators: 

Run the Security Clearance report to generate a list of your operators to review. Pay particular attention to System Administrators, but also review other levels such as Site Administrator, Administrator, and Kiosk Operator. 

Review the list of operator user records and determine which need to be removed. 

In KeepnTrack go to Users and locate and select the operator you want to remove. Click the Lock icon to unlock the record. Go to the Actions button next to the lock and choose Remove Users, then select Yes, Remove. 

Repeat these steps for all operators you need to remove. 

---

That’s it! You now have the knowledge to successfully manage passwords in your KeepnTrack system.