Get LastPass Free

Multi-device password management and sharing for 1 person.

Personal

Premium password management for family or group of 6 people.

Families

For Personal use

For single teams just getting started with password management.

Teams

Designed for businesses of all sizes, from small startups to enterprises.

Business

Gain complete visibility into your organization’s entire SaaS footprint.

Business Max

Designed to keep your clients' credentials protected and private

For Business Use

Free LastPass Business trial, no credit card required.

Free LastPass Premium trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Products

Password management

Save and autofill

Password generator

Password sharing

Dark web monitoring

Security dashboard

Passwordless vault login

User management

SaaS monitoring

Business sharing

Multifactor authentication

Integrations

Single sign-on

Identity management

Administrative

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by roles

Solutions

Pricing

Case studies

Webinars

Product demos

Events

Blog

Trust Center

Compliance Center

Security architecture

LastPass University

Resources

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Distributors

Cloud Marketplaces

Technology Alliance Partners

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

Product status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Chat with sales

Call sales

Email sales

Request a demo

Find a partner

Contact sales

Log in

When you outsource your IT needs to Managed Service Providers (MSPs), you hand over control of critical internal systems and administrator accounts. With that level of access, MSPs inevitably manage many client credentials - often hundreds or thousands of them. With privileged access to customer systems and countless passwords, your MSP is an attractive target for hackers looking to get “the keys to the kingdom.” Password management is therefore critical for MSPs looking to ensure credentials are correctly kept track of and protected. 
<h3>How hackers target MSPs</h3>
Hackers target MSPs <a href="https://www.zdnet.com/article/us-secret-service-reports-an-increase-in-hacked-managed-service-providers-msps/#:~:text=Tens%20of%20MSP%20hacks%20in%202019&amp;text=In%20a%20report%20published%20in,the%20networks%20of%20their%20customers" target="_blank" rel="noopener">with a range of cyberattacks</a> that attempt to gain access to accounts, networks, and databases. With the rise in remote work, hackers take advantage of employees <a href="https://blog.lastpass.com/2021/03/the-role-of-password-security-in-the-work-from-anywhere-world/" target="_blank" rel="noopener">beyond the traditional purview of IT</a>.

Password spraying, for example, is a type of brute-force attack where hackers try to log in to lots of different user accounts using a single password guess. Then they rotate through all the user accounts again, with a second password guess, thereby avoiding detection of many account-lockout settings. Strong, unique passwords are a deterrent for password spraying.

Credential stuffing, on the other hand, leverages usernames and passwords leaked in a data breach. Because people frequently reuse passwords, hackers can use the leaked usernames and passwords and automate the guesses to check which logins will work. Again, unique passwords for every account can mitigate this standard cyber attack. 

Ransomware is <a href="https://www.csoonline.com/article/3453849/why-you-should-consider-your-managed-service-provider-an-insider-threat.html" target="_blank" rel="noopener">a popular choice</a>, where hackers exploit known vulnerabilities to deploy malicious software on company computers or trick employees into clicking a download link. Hackers hold the data hostage until the victims pay a ransom or an organization complies with a hacker’s request. Not only is training on phishing necessary, properly managing and securing passwords reduces the likelihood someone can gain a foothold in the system to deploy ransomware.

These types of automated attacks are common. Usually, hackers are looking for easy hacks that can be programmed with software and require little work on their part. But if hackers know an MSP provides a service to a particular company, they may intentionally target that MSP to find a way into their customer’s system. For example, several years ago, hackers <a href="https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/" target="_blank" rel="noopener">broke into a third-party vendor and stole Target’s network credentials</a> used by that vendor. The result was one of the largest data breaches up to that date and a lengthy, costly lawsuit.
<h3>Why MSPs need a password manager</h3>
Given how attractive MSPs are as a target and the range of tactics hackers employ to steal data from MSPs, you should confirm that your MSP is indeed using a password manager. Achieving strong security means thinking about how an attacker may find a way in, and how MSPs can inadvertently supply that access. It’s not enough to document credentials in a password-protected spreadsheet. 

Enterprise password management software not only captures and encrypts all credentials in use to manage client services, but it also facilitates secure and encrypted password sharing among team members while tying actions to individuals. That last part is essential because it maintains accountability and a “paper trail” for auditing purposes. 

An MSP is critical to their clients’ daily operations, with access to lots of sensitive data. MSPs should therefore make reasonable efforts to mitigate the risk of breach and reduce any possibility of downtime. A data breach can suspend operations for hours or days, and it can, of course, result in lost customers, poor PR, legal fees, lost revenue, and other damage to the business. 
<h3>Next steps for MSPs</h3>
Any MSP providing services to clients needs to have enterprise password management (EPM) software in place. 

An EPM solution tracks password security across all MSP employees. Features like a built-in password generator, secure credential storage, and automatic credential filling help the MSP use strong, unique passwords to protect both the MSP’s systems and their clients’ systems. 

Passwords can be securely shared with clients and colleagues via the password manager while maintaining high security standards with encryption and reporting. <a href="https://blog.lastpass.com/2021/03/introducing-the-new-admin-console-adoption-dashboard/" target="_blank" rel="noopener">Usage of the password manager features</a> and improvement of password security over time can be centrally tracked and administered.

In summary, an EPM solution takes many of the annoyances out of passwords for MSPs while helping them provide the highest levels of password security for their clients. 

LastPass <a href="https://blog.lastpass.com/2020/07/lastpass-launches-managed-service-provider-msp-solution/" target="_blank" rel="noopener">provides MSPs a tailored solution</a> that offers visibility and control over every access point of their clients’ businesses via a unified admin console. If your MSP is ready to tackle password security, learn more about our <a href="https://www.lastpass.com/business-solutions" target="_blank" rel="noopener">business solutions</a> and <a href="https://www.lastpass.com/channel-partners" target="_blank" rel="noopener">the benefits of using LastPass as an MSP</a>.

Why Your MSP Needs a Password Manager

When you outsource your IT needs to Managed Service Providers (MSPs), you hand over control of critical internal systems and administrator accounts. With that level of acces[..]

Today marks the inaugural <a href="https://www.idsalliance.org/identity-management-day-overview/" target="_blank" rel="noopener">Identity Management Day</a>, a new annual awareness event on the second Tuesday of every April. Founded by the <a href="https://www.idsalliance.org/" target="_blank" rel="noopener">Identity Defined Security Alliance (IDSA)</a>, Identity Management Day aims to educate IT decision-makers “about the dangers of casually or improperly managing and securing digital identities.”

But what is identity? And why should businesses care about identity management, especially if resources and budgets are stretched thin? How can IT decision-makers implement or improve upon identity management systems to address IT and employees’ needs in an increasingly remote work environment.
<h3>What exactly is identity?</h3>
The term "identity" has many uses, but Identity Management Day focuses on the context of managing employee identities at work. In that environment, identity connects a person to their work and the resources they use.

In the workplace, your "identity" is the data used to verify you. An identity may include pieces of information you know (an email address or password) or devices you have access to (your phone). It may consist of your own physical or behavioral characteristics (a fingerprint) and even background information that is supplied behind the scenes but is otherwise “invisible” to you (your IP address or typing patterns). Those data points can build a profile to keep track of your activity and give you access to physical and digital resources.

In summary, <a href="https://blog.lastpass.com/2020/01/an-introduction-to-identity-with-lastpass/" target="_blank" rel="noopener">an identity proves that you are who you claim to be</a>. Anytime you need to log in to the corporate network or swipe into the office or open your work email, various data points prove you are the right person and that you should have permission to continue.
<h3>Identity is paramount to business security</h3>
Over the years, businesses have expanded the definition of “workplace” to include working from home, working on the road, co-working, and other remote work scenarios. The COVID-19 pandemic further accelerated digital transformation for many businesses, particularly in industries that to-date were slow to embrace virtual work.

Identity is essential to efficient work and maximum security, no matter where employees happen to be working. Centralized identity management affords IT teams greater control and removes common obstacles for employees like tedious login prompts and demanding security requirements. In today’s work-from-anywhere world, it’s even more critical that IT <a href="https://blog.lastpass.com/2020/03/identity-management-enabling-secure-scalable-business-growth/" target="_blank" rel="noopener">makes identity management a top priority</a>.

Proper identity management also helps prevent bad actors from gaining physical or digital access. The ISDA reports that “79% of organizations have experienced an identity-related security breach in the last two years, and 99% believe their identity-related breaches were preventable.” Employees with too much access - like admin privileges that are inappropriate for their role - can unintentionally cause data breaches, too.

In short, poorly managed identities can be a security liability and resource drain. Using an identity solution to centrally manage user access can improve the employee experience, boost efficiency, and better safeguard the business from cyber threats.
<h3>Managing identity in a work-from-anywhere world</h3>
Creating and managing workplace identities requires an identity solution. Implementing an identity solution should be cost-effective and scalable. Not only should a solution meet IT’s requirements for security and administrative oversight, but it should also meet employee requirements for usability.

For businesses with smaller IT teams, limited resources, or less room in the budget for a full suite of cybersecurity tools, an identity solution can be an intelligent investment to create a strong security foundation. With <a href="https://blog.lastpass.com/2020/02/identity-management-from-3-perspectives/" target="_blank" rel="noopener">a holistic identity solution</a>, IT can adequately safeguard privileged accounts, create a security culture across the organization, make strong passwords the norm, connect employees with behind-the-scenes authentication protocols, and add extra protection to work resources with multifactor authentication.

Identity Management Day provides an opportunity to evaluate how your company is currently managing identities and any ongoing identity-related challenges facing the organization, especially within the remote work landscape. Expanding your current identity program to ensure all access points are properly secured or investing in a new identity solution like <a href="https://www.lastpass.com/products/identity" target="_blank" rel="noopener">LastPass</a> can significantly improve work efficiency while reducing cyber threats.

Identity Management Day Reminds Us of the Importance of Identity in a Work-From-Anywhere World

Today marks the inaugural <a href="https://www.idsalliance.org/identity-management-day-overview/" target="_blank" rel="noopener">Identity Management Day</a>, a new annual awareness event on the second[..]

When the COVID-19 pandemic unexpectedly forced businesses and their employees to work remotely for the foreseeable future, PeopleKeys was faced with a unique challenge. A leading provider of behavioral assessments and team building, leadership, conflict resolution, and talent management training, development, and consulting, a substantial part of PeopleKeys’ work was conducted onsite and in-person.

With the announcement of the mandated stay-at-home order by their home state of Ohio, the sudden realization struck that PeopleKeys needed to adopt an entirely new approach by moving meetings and trainings with customers to occur virtually online. Simultaneously, the PeopleKeys team raised the concern about security with the shift to working from home.

After an extensive evaluation of potential solutions, PeopleKeys honed in on a combined solution of <a href="http://gotomeeting.com/" target="_blank" rel="noopener noreferrer" data-wpel-link="internal">GoToMeeting</a> and <a href="https://www.lastpass.com/business-solutions" target="_blank" rel="nofollow external noopener noreferrer" data-wpel-link="external">LastPass</a>. LastPass was leveraged to enable the team to set up, utilize, and share strong passwords for their accounts and programs. Not only was this a crucial and progressive step towards improved data security, it helped ease the burden of the shift to working from home full time.
<blockquote>“I could access all my programs from home. I didn’t have to worry. Just add LastPass to your browser, enter your master password, login and boom, everything is there. It was a huge benefit to have that,” said Emily Miller, Marketing Manager at PeopleKeys.</blockquote>
GoToMeeting offers a reliable, easy-to-navigate interface that PeopleKeys was looking for to empower their teams to stay connected. As the pandemic acted as a forcing mechanism to accelerate the adoption of virtual customer training, GoToMeeting became the supporting platform, helping them also to expand their reach and increase the number of clients they can serve globally.
<blockquote>“It’s increased our capacity to deliver training worldwide with the GoToMeeting technology. It’s been a real benefit to us,” stated John Schindell, Director of Training at PeopleKeys.</blockquote>
For the full story of how GoToMeeting and LastPass set the PeopleKeys team up for success in their remote work productivity, connectivity, and security, please visit <a href="https://www.goto.com/-/media/cc6964c7ebd647029454411dbd849176.pdf" target="_blank" rel="noopener noreferrer">here</a>.

Customer Spotlight: How LastPass and GoToMeeting Aided PeopleKeys' Transition to Remote Work

When the COVID-19 pandemic unexpectedly forced businesses and their employees to work remotely for the foreseeable future, PeopleKeys was faced with a unique challenge. A leading provider of behaviora[..]

As a growing technology company, Natterbox employees require access to multiple cloud-based sites in order to complete their daily tasks. However, managing the credentials to multiple cloud accounts in a secure way was burdensome on employees. Natterbox required a solution that would allow their employees to securely manage and access their cloud applications as well as securely share credentials between team members. 
In addition, Natterbox relied on multiple two-factor authentication solutions to secure their infrastructure. Different authentication solutions were used for different applications. Natterbox was looking for an opportunity to streamline their authentication experience to create a consistent end-user experience. 
LastPass allows Natterbox to create a simple, consistent experience for access and authentication to cloud applications. With access, LastPass single sign-on (SSO) secures key applications, such as Salesforce, to reduce the number of accounts that end-users need to manage. Password management ensures that all non-SSO enabled applications employ strong credentials to reduce the risk of a security threat.  
For authentication, LastPass MFA provides Natterbox an opportunity to streamline their end-user authentication. In addition, LastPass MFA geofencing policies allows Natterbox to restrict access from other countries and provides a strong final layer of defense.  
“LastPass Identity provided us a password management, single sign-on, and multi-factor authentication solution that is easy to manage and creates a consistent end user experience.” – Adrian Evans, Chief Information Officer, Natterbox 
Results:  
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">Many of Natterbox’s employees were new to password management, but LastPass intuitiveness made it easy for employees to get up-and-running quickly. In addition, the LastPass security score helps IT to monitor compliance as well as adoption.  </li>
<li data-leveltext="" data-font="Symbol" data-listid="1" aria-setsize="-1" data-aria-posinset="2" data-aria-level="1">LastPass changed the password culture at Natterbox. Now, employees don’t have to be burdened with remembering their complex passwords. With LastPass, employees rely on single sign-on, password management, and multi-factor authentication to securely access their cloud applications.  </li>
<li data-leveltext="" data-font="Symbol" data-listid="1" aria-setsize="-1" data-aria-posinset="3" data-aria-level="1">With LastPass, Natterbox enhanced their internal security and reduced the threat of compromised credentials impacting their business. </li>
</ul>
To learn how LastPass Identity can help your organization, visit <a href="https://www.lastpass.com/products/identity" target="_blank" rel="noopener noreferrer">https://www.lastpass.com/products/identity</a>

Customer Spotlight: How LastPass Identity Provides Unified Security for a Technology Company

As a growing technology company, Natterbox employees require access to multiple cloud-based sites in o[..]

SMA Technologies was founded by a team of automation experts at NASA that saw an opportunity to bring automation to the IT industry. Today, SMA Technologies has over 600 clients in 24 countries using their OpCon automation platform. 



SMA Technologies holds a high security standard for their organization by following the security practices set by ISO 27001. One key aspect of these standards is ensuring controlled access to all systems for both internal and external users. 



As SMA Technologies relies on sharing passwords to access shared logins, they needed a solution that would provide a secure and reliable method for sharing credentials while maintaining their high security standards. In addition, SMA Technologies infrastructure system is predominantly cloud-based. More cloud-based applications mean more passwords and logins for their end-users. SMA Technologies wanted to find a way to minimize the number of passwords that their end-users would need to manage. 



LastPass helps SMA Technologies to meet their high security standards. LastPass allows SMA Technologies to reduce the number of credentials that their end-users must input through its single sign-on capabilities. With single sign-on, end-users only need to provide credentials once before having access to many of their work applications. 



In addition, SMA Technologies relies on LastPass password management to secure all passwords for applications or sites that are excluded from single sign-on. SMA Technologies also utilizes shared folders to easily provision or de-provision users to credentials – allowing the IT team to maintain control over user access. 



 “With LastPass single sign-on and password management, we’ve been able to minimize where our end-users have to login each day - ensuring we meet our high security standards” - Tye Summerville, IT Network &amp; Services Manager 



<h2>Results:</h2>



<ul><li>SMA Technologies found it easy to enable LastPass in their environment. For the IT team, LastPass allows them to support their teams across global offices in a streamlined fashion. By having sign-on and password management in one comprehensive solution, the IT team can manage access in one place. </li><li> SMA Technologies has seen the number of password-related ticket requests decrease significantly since deploying LastPass. This allows the IT team to focus less on administrative tasks and more on value-add projects. </li><li>For the users, LastPass allows them to easily access their work cloud applications from any device, reducing the frustration of forgetting or changing old passwords while increasing their security. </li></ul>



Learn more about LastPass single sign-on and password management by visiting: <a href="https://www.lastpass.com/products/enterprise-password-management-and-sso">https://www.lastpass.com/products/enterprise-password-management-and-sso</a>

Customer Spotlight: How SMA Technologies Ensures Security with LastPass Single Sign-On (SSO) and Password Management

SMA Technologies was founded by a team of automation experts at NASA that saw an opportunity to bring automation to the IT industry. Today, SMA Technologies has over 600 clients in 24 countrie[..]

In 2018, to support our vision of world-class security, LogMeIn leadership decided to dedicate a full team to taking care of and constantly improving LastPass’ security. Our team was formed to get the most from the company standards and raise the bar of security across LogMeIn by providing a great example for every other product.
<h2>Building a Dedicated, Versatile Security Team</h2>
The team initially consisted of LastPass engineers who were enthusiastic about security, to guarantee hands-on domain knowledge and to make sure we are able to act on issue resolution and mitigation. As the team grew, we extended the team with security experts to bring in the attacker mindset. We were able to combine the best from both worlds – both the attacker and defender mindset represented in one team. From the beginning, the team was geographically distributed to cover more working hours across the globe.

The team is built around multiple topics and focuses on satisfaction of both internal and external customers. External customers include LastPass users and the security researchers we engage with on Bugcrowd. We work hard to make them feel more secure, to build trust with us and our product, and to keep them satisfied with the offered services. Our internal customers include engineering, product, sales, marketing, PR, and the customer care organization, all of whom work to support the LastPass service. We are providing services for them to rely on any time security comes into question.
<h2>Improving Our BugCrowd Program</h2>
Our first target for improvement was our public bug bounty program. Rather than rotating responsibility for security issues among individuals or teams, we now have a dedicated team. This has allowed us to improve our response time, follow a more standardized process internally, and communicate more openly. We’ve also been able to improve our relationships with security researchers. We are able to be involved in the early stages of submission validations if needed, and are able to more quickly raise awareness internally of any incoming issues in a way that is digestible for stakeholders.

Our security engineers are also able to act quickly and start working on fixes or mitigation, but we are also prepared to provide full context, involve engineers from other teams and coordinate the combined effort where it is needed for fixing issues as fast as we can. The dedicated team also has the ability to identify systemic issues and drive efforts to fix root causes, as opposed to merely fixing isolated issues.

Last but not least, recently we updated the description and the scope of the Bugcrowd program to provide more guidance to the researchers based on lessons learned in the last year and comments from researchers. We’ve also improved our internal security activities to reduce the attack surface and identity issues before a researcher may find them.
<h2>Cultivating a Security-Minded Engineering Organization</h2>
In our experience, achieving strong security requires a different mindset, and means spreading knowledge across the engineering organization.

Internally, we started providing more growth opportunities to our engineers, including training on how to acquire an attacker mindset, to learn more about security best practices, and to internalize lessons learned from the field of identity management. With a fast-growing engineering organization, we are also responsible for making sure that everyone, including new hires, are aware of security best practices from the beginning. Our team is dedicated to regularly sharing lessons learned with the entire LastPass and LogMeIn engineering organization on different forums. We not only share our security team’s internal knowledge but also include best practices from all over the world gathered from researchers via our bug bounty program.

In addition to raising awareness, we also actively help our engineers bring the security focus into every phase of software development, from planning through to release, as part of our standardized security development lifecycle practice. Because our dedicated security engineers share the same domain knowledge and are working on the same code base as all LastPass engineers, security design review sessions are even more fruitful and interesting. Our engineering teams are proactively requesting reviews by our team to see what we can find together.

Threat modelling and security review sessions are kept professional and even spiced up with some fun. We use an escalation of privileges card game for threat modelling. We make sure we have a constructive atmosphere where we tear apart a solution all together, including the engineers who originally planned and implemented the code. Everyone is interested in finding issues to win the game.

The human factor is always mentioned as a problem in cybersecurity. I think it is only a problem if you do not allocate enough time and effort into raising awareness and training people. Also, supporting engineers with reasonable and effective processes – and educating them on why – will motivate them to follow those requirements, instead of looking for loopholes that could lead to bigger issues. With a dedicated security engineering team, we are able to constantly work on improving processes and helping people based on their feedback and their needs.

As a result of building a mature engineering organization focused on security, we are much more effective in maintaining our vision of world-class security. It remains our mission to deliver customer satisfaction by delivering secure solutions that our customers can trust to secure the data of their businesses and their families.

&nbsp;

<a href="https://www.linkedin.com/in/ferenckun/">Ferenc Kun</a> is the Security Engineering Manager for LastPass at LogMeIn. He focuses on leading a dedicated security team that oversees compliance and penetration testing, security assessments of the product, and integrating the key pillars of core SDL into the development lifecycle. Ferenc has been with LogMeIn for 5 years, with experience as a developer for multiple LogMeIn products.

A Look into the LastPass Security Team

In 2018, to support our vision of world-class security, LogMeIn leadership decided to dedicate a full team to taking care of and constantly improving LastPass’ security. Our team was formed to get the[..]

Our team is thrilled to announce that we have selected three finalists for the 2019 LastPass STEM scholarship. 

Earlier this year, we announced that LastPass was teaming up with LogMeIn’s corporate responsibility program, Mission Possible, to launch <a href="https://blog.lastpass.com/2019/01/lastpass-stem-scholarship-10000-towards-tuition.html/">the LastPass STEM scholarship</a>. By submitting the application and responding to our essay prompt, high school seniors and currently enrolled college students studying or intending to study STEM fields were eligible to win $10,000 towards tuition and $2,000 towards books. We will be announcing our final scholarship winner on July 1st.

We want to thank all the students who applied for this year’s scholarship, and all those in our community who helped to raise awareness of the scholarship. We received 145 applications from students across the United States, studying fields ranging from mechanical engineering to computer science to biology and more. 

We were particularly impressed by the thoughtful, unique responses to our essay prompt. We asked students to consider the link between human behavior and technology, and what it says about the future of security. Many students pointed to the biases, attitudes, and learned behaviors that make people lazy when it comes to online security. Others pointed to misplaced trust and an overreliance on technology itself to provide security. 
<blockquote>“In the minds of many, the threat of data theft does not register into the subconscious, even if one rationally acknowledges the risk,” wrote finalist Samantha L. “One can consider other risks that frequently go unmitigated. For example, one might ask why so many people refuse to buckle their seatbelts, or perhaps why it may be that people start smoking despite knowing the health hazards? These issues, while different in topics, are similar in nature.”</blockquote>
In other words, human psychology can explain why we continue to do things that we know are bad for us or aren’t helpful in the long term, and the world of cybersecurity is no different.
<blockquote>“We want technology to improve our lives. To make it easier, make it happier, and allow us more time to do the things we care about. We do not want technology to be another thing we have to worry about or waste time understanding or fixing,” wrote another finalist, Jessa K. “[…] In order to more effectively protect us from digital threats, there are two challenges that need to be tackled. First is raising awareness of the importance of cybersecurity. […] The second challenge is to make cybersecurity easy. To have it work in the background, to take the burden off the user, to make it a task they can hand off to trusted experts.”</blockquote>
What does that mean for the future of cybersecurity? Many of our applicants pointed to technologies like password managers, multifactor authentication, biometrics, and artificial intelligence that can already be leveraged to improve personal cybersecurity. Others pointed to the need for security to be built-in to technologies whenever possible and reduce the impact that any human behaviors or errors can have.
<blockquote>“The solution for cyber security is to recognize how human behavior is linked to technology, and to balance technology’s ability to improve security against the lazy tendencies of humans,” wrote finalist Joseph J. “Without technology improvements in cyber security, people will continue to fall prey to cyber threats like phishing scams. Therefore, technology must improve by constructing new processes that help people increase their cyber security, while simultaneously acknowledging and addressing the tendencies of humans to resist change.”</blockquote>
With so many well-written responses, choosing our three finalists was tough! Now, the three finalists will now be submitted videos in which they discuss why they chose a STEM major and what impact they hope to make with their education. We look forward to sharing our final winner on July 1, be sure to check our <a href="https://www.lastpass.com/scholarship">official scholarship page</a> for the announcement!

Announcing the LastPass STEM Scholarship Finalists 

Our team is thrilled to announce that we have selected three finalists for the 2019 LastPass STEM scholarship. 

<span data-contrast[..]

What an incredible decade it’s been! We launched LastPass 10 years ago, and it's safe to say a lot has changed, but our dedication to password safety and cybersecurity has not.

Over the years, we’ve launched new products, enabled new security features, and grown in so many ways - all thanks to the support from users like you. Check out some LastPass stats that highlight just a few of our accomplishments over the years.

2008: The year it all started in Virginia with four security-minded friends

5 products: We’ve launched 5 different ways to love LastPass: Free, Premium, Families, Teams, Enterprise

426 blogs posted and counting

4.5 average rating on the App Store

16.8 Million LastPass users and counting!

<a href="https://www.lastpass.com/10th-anniversary" target="_blank" rel="noopener noreferrer">Visit our 10 year anniversary page</a> to see highlights from LastPass history, and to find out how to win a LastPass anniversary t-shirt.
Official Rules: <a href="https://cdn.lputil.com/wp-content/uploads/MyLastPassStory-Official-Rules-7-9-18_.pdf">#MyLastPassStory Contest</a>

&nbsp;

Check out our highlight reel:

<div id="embed"><iframe width="560" height="315" src="https://www.youtube.com/embed/QARcHHfQGFA?feature=oembed" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" name="fitvid0"></iframe></div>

Celebrating 10 Years of LastPass

What an incredible decade it’s been! We launched LastPass 10 years ago, and it's safe to say a lot has changed, but our dedication to password safety and cybersecurity has not.

Over the years, we’ve [..]

It’s already the 4th week of National Cyber Security Awareness Month and this week the focus is on careers in cyber security. There are many ways to approach this topic, and I wanted to look at it through the lenses and experiences of a truly passionate group: women in cyber security.

<a href="https://iamcybersafe.org/wp-content/uploads/2017/03/WomensReport.pdf">The 2017 Global Information Security Workforce Study: Women in Cyber Security</a> provides a lot of detail and insight into the gender divide in the cyber security industry.  Only 14 percent of cyber security pros are women which is a bit startling if you consider the fact that women make up 48 percent of the entire U.S. workforce.

I interviewed three of my female peers about their experiences and asked for their advice to women who work in the industry, or are interested in exploring cyber security. However, their insights and thoughts are surely relevant for everyone in this industry and even beyond, regardless of gender identity.

My Three Experts 

Hannah Dalke, Senior Product Manager at LogMeIn focuses on shaping the direction of LastPass. Hannah is focused on the consumer side of our business, experience she’s applied from a past post at a big travel company. She noted, “Working in security is a different vibe. It’s technically ok to make a mistake with a person’s vacation, but if you make a mistake with security it can affect their whole life.”

Sara Czyzewicz is a hands-on LastPass software engineer, architect and coder who develops web, mobile and standalone password management applications here at LogMeIn. Sara previously ran her own startup that developed an identity platform that identified an individual's future interests by scanning their social media sites and digital life.

Erica Antos is the Senior Director of Governance, Risk and Compliance at Nuance Communications, a company that develops artificial intelligence (AI) and voice-driven technologies.. She oversees security operations including vendor reviews, IT initiatives, policy frameworks and risk assessments, and the means to track and measure it through GRC technology tools.

How do you see gender diversity in cyber security?

Hannah noted that while engineering is typically male dominant, its not something that phases her. “In fact, I enjoy being in a male-focused industry… You are always going to have some people who are going to look at you differently. But when I feel good after doing a good job, it’s kind of like ‘I told you so.’”

Sara sees gender diversity as a challenge in almost mostly every tech field, “I think that gap is slowly but surely closing. A lot of that has to do with initiatives that encourage women to be get involved in STEM [science, technology, engineering, and math] fields, and those women-focused networking events and conferences. It is very important to have the support from everybody including male counterparts.”

What skills do you feel are most critical for working in security? 

Erica noted that it’s particularly important to be an effective communicator and negotiator. “You not only have to be able to articulate security, but also do it in a way where you can connect with both male and female senior executives. It can’t just be ‘We need to implement this firewall.’ The need must be translated in a way where business stakeholders understand the value and why it is needed, and not just because we say so, and by the way it costs this much.”

Hannah also acknowledges that communication is critical. “It is very important to be open and communicate if something goes wrong.” She added that being able to understand pain points quickly helps find the right project for the right experience. For her, a lot of it comes from common sense and a gut feeling.

For Sara on the engineering side, the awareness of the latest news and security breaches is key. “It’s important for me to stay on top of new attacks that have occurred, and new standards and platforms to consider integrating with your product or services.”

Given it's National Cyber Security Awareness Month, what can we do to help others become more educated and diligent?  

“Working in security we have an important role to maintain an open web while still being able to confidently provide the tools and methods to keep that private. It’s a combination of empathy and taking people’s privacy very seriously,” Sara noted. “What we do and what we build is truly helping people to enjoy and utilize the wealth of information at their disposal via the web. It could be otherwise inaccessible or dangerous without security.”

With Hannah’s focus on consumers (rather than business users), she advises that security professionals would be more effective in their jobs if they think about the role that security plays in everybody’s life, including their own, and not just their customers and clients.

At Nuance, Erica plays a big role in general security awareness and has advice for anyone trying to up the general security IQ. “Security should be a learning opportunity in the moment, and not some sort of forced drudgery. Make it part of the culture so it’s a continuous opportunity and not just a point in time. You can capture more people’s attention when you include things that help them be more security aware in their personal lives too.”

What’s your advice for other women looking to work in cyber security?

Sara believes being able to effectively represent your ideas is critical.  “Not being shy is really important. I lucked out because I was coding at age 13 because my uncle was an engineer. So I was never really shy about it. I have seen women too timid to attend events or speak up. That’s yet another reason why everyone on the team needs to be involved in building a good culture.”

Sara just signed up as a mentor fora Boston-based group called “<a href="https://www.girldevelopit.com/">Girl Develop It</a>." It’s technical and mostly for junior engineers or those completely new to coding. Their mission statement is “Don’t be shy. Develop it.”

Hannah encourages women who have an idea to push for them, make sure they are heard, and don’t back down. “If someone says no, keep pursuing it. Take it as a challenge, not as an insult or as something taken personally. Just use it as something to better yourself.”

Finally, Erica’s advice, “It’s a big field, explore every opportunity within it. Be tenacious in your goals. Push past issues you can’t fix, but advocate for change nonetheless. At the end of the day, let your work speak for itself.”

And that’s good advice for anybody.

NCSAM Week 4: Good Advice and Teachable Moments from Women in Cyber Security

It’s already the 4th week of National Cyber Security Awareness Month and this week the focus is on careers in cyber security. There are many ways to approach this topic, and I wanted to loo[..]

We recently chatted with Ben Docksteader at Influitive, an advocacy marketing company with offices in the United States and Canada. Our own customer advocacy team talked to Influitive about using their services and they mentioned how much they love using LastPass in their offices. Turns out they’ve been using it in their 150 employee company since 2013. From there, we had a great conversation with Ben, Manager of Engineering Operations, about how LastPass makes shared access seamless (and secure), and even makes security seem easy and fun for employees.
<h2>What led Influitive to start using LastPass?</h2>
Today, there is no company that can take security lightly. Endpoint protection and password controls for sensitive accounts are part of our Security Policy at Influitive. We show these controls to many customers who demand we have them in place to pass security reviews. They are also required as part of greater privacy legislation like GDPR and PIPEDA that require implementing practices like the principle of least privilege.

Adopting a password management tool was and continues to be a legal requirement for us but it’s also just more efficient. Sharing passwords with colleagues, setting up new people through onboarding, or locking down access on role changes. All of these things help us get to greater business continuity.
<h2>What do you like best about using LastPass?</h2>
The best part of LastPass is distributing access to key applications throughout the organization. There’s nothing worse than wanting access to an app that you can’t get to. Most of the time when people come to me and ask, ‘how do I get into ... ?’’ I simply reply, “check LastPass.”
<h2>How has LastPass helped the Influitive community improve online security practices?</h2>
LastPass is a big part of our company security policy (and one of the more fun parts). We’ve started to use the Security Challenge to measure the strength of our passwords and identify where we are most vulnerable. We also use it to teach those who are less familiar with password security using tools like the password generator and the security challenge.

These are the elements of LastPass that directly impact employees and make their jobs easier. Most security policies make things harder for employees, so it’s a nice change.
<h2>What would you recommend to those who are new to LastPass?</h2>
I would recommend setting up LastPass for the sites they use the most often (especially those where they have multiple accounts), use the LastPass browser extension and just see how quick it is to log in to your services. I would tell them to forget every password they’ve ever remembered, put them all in LastPass, and spend a good 20 minutes creating and memorizing your last password.
<h2>LastPass is an essential workplace tool for us because…</h2>
It keeps us secure AND it’s the best way to manage the apps we use everyday.

Customer Spotlight: How Influitive is Making Security Fun for Employees

We recently chatted with Ben Docksteader at Influitive, an advocacy marketing company with offices in the United States and Canada. Our own customer advocacy team talked to Influitive about using thei[..]

The beginning of the school year is just around the corner, and as the parent of a soon-to-be third grader I’ve been barraged by a slew of online and accounts I’ll need to access on a regular basis. These accounts connect me with online retailers for back-to-school clothes and gear, sites and portals related to after-school activities, online testing, parent/teacher communications, blended learning, and more.

Being naturally interested in password security I thought I’d Google what advice is being shared with parents like myself to keep everything straight. There were well-written pieces of advice around cyberbullying and mobile device security, and something called shoulder surfing which pretty much equates to copying someone’s homework without permission.

What I found for password security tips became a lot less sound. Most articles recommended strong passwords that use a combination of upper case and lower case letters, numbers and characters; this advice was pretty consistent and fair enough. Nothing that can be guessed, and never the same password for more than one account. Got it.

But what caught my eye, and this where I felt the advice kind of fell apart, was guidance on the ideal length of a password. Allow me to quote some of these particular nuggets of wisdom:
<ul>
 	<li>“The guideline for a strong password is one that is 20 characters long.”</li>
 	<li>“Create long, strong and unique passwords for each email account, school login, and social media site.”</li>
 	<li>“Make sure you use a complex and unique password for each account/system that are at least 10 characters long.”</li>
</ul>
Let me do the math based on this collective advice.

There are approximately a dozen accounts I need to manage that relate in some way to activities surrounding the school year. This doesn’t count all the personal online accounts and websites that I maintain, mind you. Each account should have a unique password. And each of those unique passwords should be between 10-20 unique characters long. To make it even more complicated, many of these accounts will need me to change login credentials at least once during the school year, if not much more often.

Oh, I forgot the best part: don’t write them down.

I’m not sure what the exact calculation would be in this case, but suffice to say that it’s a bit too unrealistic for anyone, busy parent or otherwise.

There Shouldn’t Be Even a Fine Line Between Secure and Convenient

The line between security and convenience is not a very fine one. In fact, there’s just too much space between the two. Moms and Dads everywhere are likely less worried about security and more worried about being able to download their child’s homework assignment before it’s due.

Parents I have discussed this with have two consistent needs:
<ul>
 	<li>A single place to manage all the passwords they need to maintain</li>
 	<li>Keep details safe and secure</li>
</ul>
Fortunately, the two can meet in the middle in the form of a password manager.

A Password Manager The Whole Family Can Enjoy

Using a password manager was one bit of advice that I found in about one out of every five articles during my Google search. I’ll quote one of my favorite instances of this, from <a href="https://www.pcmag.com/article2/0,2817,2421835,00.asp">an article</a> in PC Magazine article written by Neil Rubenking four years ago*:

“Passwords protect more than email accounts. You probably have dozens of password-protected websites, school-related and otherwise. One easy way to handle this plethora of passwords is to just use the same password everywhere, maybe something clever like "password" or "monkey." OK, that's dumb, but without the help of a password manager you'll be hard-pressed to remember unique, strong passwords for every site.”

A password manager like <a href="https://www.lastpass.com/">LastPass</a> makes it very easy to create long, complex passwords using any required combination of characters, for every online account. No matter how frequently passwords need to be changed, and without the trouble of having to remember a single one of them. Instead, the only thing I need to remember is a single passphrase that’s easy for me to remember and extremely difficult for anyone to guess.

And considering it’s back to school season, even better is our new where you can store your entire family’s passwords, bank accounts, credit card data and more. It’s easy to organize and share as the “family manager” can add or remove members of the family or even designate another manager.

For example, I share certain credentials with my nanny so she can access sites related to my daughter’s school and healthcare. My father shares access so I can access bank account and healthcare information in case of emergency.

Who in your life would you share access with? Perhaps you have a child attending college and want to give them access to Netflix or Hulu. (And, should you feel the need, you could even revoke access the week before exams.) Or maybe you’d like to share access to your Amazon Prime account with your sister so she can take advantage of free shipping.

In more detail, LastPass Families includes these neat features:
<ul>
 	<li>A family backup plan
Combine all valuable information, from online bank accounts to Social Security cards to healthcare details, in one place and <a href="https://blog.lastpass.com/2017/02/family-affected-by-als-uses-lastpass-to-make-life-easier.html/">give emergency access</a> to a family member so you’re never locked out in unexpected situations.</li>
 	<li>Simple setup &amp; management
With a LastPass account for up to 6 family members, LastPass Families allows everyone to easily store and access all their passwords and information, no matter what device they’re using. The lead family manager purchases the subscription and is able to designate additional managers, as well as add and remove family members.</li>
 	<li>Unlimited sharing with your family
Organize items into as many folders as you need, so you can share login credentials to household bills with your significant other, while sharing entertainment sites with the whole family – all while keeping personal sites separate in your private vault.</li>
</ul>
<img class="alignnone size-large wp-image-81695" src="https://cdn.lputil.com/wp-content/uploads/Families_Shared_Folder_Omar-IA-1-1024x560.png" alt="" width="1024" height="560" />At the end of the day I don’t want there to be even a fine line between security and convenience. I don’t even want there to be a line at all.

Considering I use LastPass to keep track of all of my passwords, securely, my only real back-to-school dread is learning what color my daughter will want to dye her hair upon her arrival home that first day back at school.

*For full disclosure I should note that Neil from PC Magazine went on to recommend his team’s password manager of choice, LastPass.

It’s Back to School Season and Time to Get My Family Organized

The beginning of the school year is just around the corner, and as the parent of a soon-to-be third grader I’ve been barraged by a slew of online and accounts I’ll need to access on a regular basis. T[..]

A few weeks ago, we had the opportunity to speak with Miguel Sanchez, who has worked in Information Security at Harvard University for over 10 years. He previously enjoyed LastPass as a personal user so when the university began a security initiative, he advocated to bring the tool to Harvard. It’s been 4 years since Harvard adopted LastPass in 2013, and still they continue to evolve their implementation.

Here is a snippet of our conversation with Miguel on how and why he brought LastPass to Harvard University:

What led Harvard to start using LastPass? How did you evaluate LastPass?
We already had CyberArk in place for privileged accounts when we started to look at LastPass. My colleagues and I had been using LastPass personally for the past few years. After hearing about a pilot with the university, I got on a panel to test the LastPass security model and evaluate the user experience. We wanted to give people an option for password management that was Harvard-funded. A big selling point for us was the option to bundle an Enterprise site license with Premium accounts for personal users. This went alongside our security initiative by doing more than just talking about the importance of password management, but also providing an actual password management solution for the community to use.

How did the community respond to LastPass?
The response is generally the same for both employees &amp; students. People who haven’t heard about password management love the idea of it. Within the Harvard staff and students, the adoption of LastPass has been slightly different. Students haven’t been a huge focus for the university but when students find out about LastPass, they’re easily up and running.

How has LastPass helped you and your community at Harvard improve online security practices?
It has helped the people who use it to become more security conscious and also somewhat helped to improve the overall security posture of the University. Within the mini-deployments, like the business school or employee credit union, they have improved their security with the use of Enterprise admin controls. These controls allow them to administer their own environment and enable group policies on their own.

What would you recommend to those who are new to LastPass?
You’ll never have to remember another password again, and it makes using the internet much easier. To get new users started, I like to equate it with a 4-week workout plan. The first week you can store just one credential in LastPass and see how it starts filling it in for you. The second week you can start filling up your vault by simply clicking the ‘Add’ button that pops up when you sign into a new website. The third week you can try generating a brand-new password. The fourth week you can change your passwords to make sure they’re up to par with password security best practices. This workout plan is basically just a slow roll out of the product.

From your experience, what do people love most about LastPass?
Everything.  When I give presentations on general security and password managers, if LastPass comes up, there’s always a few people who say they use it, they love it, or they can’t see themselves using anything but it in the future. They like the idea of having only one password, not having to fill anything in ever again, and not having to come up with new passwords.

What’s next for LastPass at Harvard?
LastPass is on our roadmap for the new year here at Harvard (our fiscal year just started in July). We want to improve our deployment plans so it’s adopted more broadly throughout the university. Specifically, we’d like to replace CyberArk, which we use for password scrambling, and move that functionality into LastPass.

Customer Spotlight: Why Harvard University Chose LastPass to Bolster their Campus-Wide Security Initiative

A few weeks ago, we had the opportunity to speak with Miguel Sanchez, who has worked in Information Security at Harvard University for over 10 years. He previously enjoyed LastPass as a personal user [..]

Blog

Blog

Recent

Industry News

LastPass For Admins

LastPass Labs

Product Updates

Tips And Tricks

Lastpass Stories

Why Your MSP Needs a Password Manager

Identity Management Day Reminds Us of the Importance of Identity in a Work-From-Anywhere World

Customer Spotlight: How LastPass and GoToMeeting Aided PeopleKeys' Transition to Remote Work

Customer Spotlight: How LastPass Identity Provides Unified Security for a Technology Company

Customer Spotlight: How SMA Technologies Ensures Security with LastPass Single Sign-On (SSO) and Password Management

A Look into the LastPass Security Team

Announcing the LastPass STEM Scholarship Finalists

Celebrating 10 Years of LastPass

NCSAM Week 4: Good Advice and Teachable Moments from Women in Cyber Security

Customer Spotlight: How Influitive is Making Security Fun for Employees

It’s Back to School Season and Time to Get My Family Organized

Customer Spotlight: Why Harvard University Chose LastPass to Bolster their Campus-Wide Security Initiative