Ensuring the Security of Your Secrets in Your Password Manager with Keeper Security

Real-world use case

You need to migrate your password manager to an enterprise-grade solution: here's my feedback from a successful migration to Keeper Security Enterprise Plus.

The LastPass hack in August 2022, considered one of the worst security incidents for a password manager, reminds us that no solution is foolproof. That's why it's crucial to properly implement the Zero Trust and Zero Knowledge model in order to maintain maximum security for your digital vault.

For my part, I started getting interested in storing passwords outside the browser back in 2009, since there were regularly major security holes that could compromise them. I started with KeePass, then Bitdefender Wallet, before eventually using LastPass in 2012. I resumed my quest for stronger security in 2019 and smoothly migrated to Bitwarden. On March 15, 2022, I permanently switched to Keeper Security.

My article is based on the Keeper Security Enterprise Plus version, in the context of a company.

Security before convenience

An enterprise password manager needs to meet strict security criteria. A good password manager isn't just convenient: it needs to be cryptographically solid, transparent, and resilient even in the event of a data breach. Here are the key points that guided me toward Keeper Security:

• Zero Knowledge
  • The provider can't access our data, even if it's hacked.
  • Encryption is done locally, on the device.
• Zero Trust
  • No implicit trust in users, devices, or networks
  • Granular access control (rights per user, per vault, etc.)
  • Real-time logging and alerts on access
  • Integration with security systems (SIEM, SSO, etc.)
  • Isolation of environments (e.g.: sandboxing, separation of roles)
• Strong encryption
  • Using AES-256 for data.
  • Key derivation via PBKDF2, Argon2, or scrypt (to slow down brute-force attacks).
• No storage of the master password
  • It must never leave the device.
  • It must not be stored, even encrypted, on the vendor's servers.
• Multi-factor authentication (MFA)
  • To strengthen vault access (biometrics, FIDO2, etc.)
• Security audit
  • The code (or at least the architecture) has been audited by external experts.
  • Security audit dashboard available
  • Bonus: open source manager (like KeePass or Bitwarden).
• Protection against offline attacks
  • Even if a vault is stolen, it must be extremely difficult to decrypt without the master password (self-destruction).
  • Encrypted backups
• Necessary add-ons
  • Leak monitoring (dark web monitoring)
  • Secure password sharing (and secure external links)
  • Offline mode
  • Multi-platform

These multiple requirements, while important to evaluate, are, in my view, essential reliability prerequisites. It's recommended to look for all the evidence confirming compliance with standards and the vendor's transparency: https://docs.keeper.io/en/enterprise-guide/why-choose-keeper-enterprise

Managing risks, not just passwords

If your manager guides you through the first configuration steps, then improving your compliance and security posture becomes even simpler. For example, Keeper's risk management dashboard offers a simplified view within Keeper's admin console, giving administrators quick and easy visibility into their organization's configuration practices and Keeper compliance posture.

All of this is very important before storing a single password. Make sure your security measures help limit, for example, the risk of unauthorized access, data theft, or loss of data integrity. The risk management dashboard relies on a set of Keeper security benchmarks to help organizations stay compliant and secure. A dedicated space for training is highly valuable to make sure you master the tool, its capabilities, and its limits, as here for enterprises: https://www.keepersecurity.com/fr_FR/msp-academy.html

Example of risk management and enhanced security in Keeper Security

Login settings

• Master password complexity:
  Set the minimum requirement for master passwords: 16
• Master password expiration:
  No expiration (if SSO)
• Allow users who log in via SSO to create or log in with a master password:
  No additional master password with SSO
• Device biometrics:
  iOS Touch ID / Face ID, Mac Touch ID, Passkey

Two-factor authentication

• Require the use of two-factor authentication:
  Yes
• Require mandatory MFA for users: web, mobile, and desktop apps:
  Yes, at every login
• Available 2FA methods:
  Security keys (+ requires a PIN code), Authenticator app (TOTP)

Platform restriction

• Allowed Keeper platform:
  Web vault, extensions, Mobile

Vault options

• Disable built-in onboarding:
  Yes
• Hide custom fields:
  Yes
• Hide notes:
  Yes
• Pause BreachWatch on client devices:
  No
• Send BreachWatch events to reporting systems and external SIEM:
  Yes
• Autofill passwords:
  No
• View and copy a password or hidden field:
  No
• Edit, share, and delete an entry or folder:
  No
• Number of days before entries can be permanently deleted:
  7
• Number of days before automatic purge of deleted entries:
  14

Creation and sharing

• Can create entries:
  Yes, and can only duplicate entries
• Can create folders:
  Yes
• Can create shared folders:
  No
• Can create items in the identity and payments tab:
  Yes
• Can upload files:
  Yes
• Can create two-factor codes:
  Yes
• Can only receive shared items:
  Yes

Import and export

• Import: Not allowed
• Export: Not allowed

KeeperFill

• Import:
  Not allowed
• Export:
  Not allowed

Account settings

• Restrict offline access:
  No
• Prevent users from changing their email address:
  Yes
• Enable Self-Destruct:
  Yes
• Prevent invitations for Keeper Family license:
  No
• Disable staying logged in: Yes
• Set the maximum and default timeout duration for inactivity logout
  • Web vault, browser extension, and admin console: 1 day
  • iOS and Android: 30 minutes
  • Desktop application and Commander: 1 day
• Disable account recovery with recovery phrase:
  Yes
• Disable email invitations:
  Yes
• Automatically resend email invitations:
  Every 7 days

IP address allow list

• Restrict vault access to an IP address:
  Yes

Account transfer

• Enable account transfer:
  No

Compliance recommendations

• Create at least two Keeper administrators:
  Enabled
• Enforce 2FA on the Keeper administrator role:
  Enabled
• Verify that an administrator exists outside of SSO:
  Enabled
• Reduce administrator privileges:
  Enabled
• Lock down your single sign-on provider:
  Enabled
• Disable account recovery where necessary:
  Enabled
• Enforce a strong master password:
  Enabled
• Enforce two-factor authentication for end users:
  Enabled
• Enable the account transfer policy where necessary:
  Enabled
• Create security alerts:
  Enabled
• Prevent the installation of untrusted extensions:
  Enabled
• Deploy across your entire enterprise:
  Enabled
• Disable browser built-in password managers:
  Enabled

Conclusion

Password security in an enterprise requires a comprehensive approach:

1. Choose a solution fully compliant with Zero Knowledge and Zero Trust
2. Configure it according to current security best practices
3. Monitor with automated SIEM alerts
4. Train teams on best practices