Corporate password managers: stop sharing the Excel of passwords
The "Office Passwords 2024.xlsx" on SharePoint is a guaranteed incident. Pragmatic rollout for hybrid teams in PR.
Schneier has asked for password managers for decades; in consulting we see sticky notes on monitors in Condado and shared Excel sheets with 200 rows. For hybrid SMBs in Puerto Rico — half office, half remote — a corporate manager (1Password Business, Bitwarden, Dashlane Teams) is cheaper risk control than an appliance.
Successful rollout: owner and management first (model), IT m
Successful rollout: owner and management first (model), IT migrates shared accounts (WiFi, bank portal, SaaS) to vaults with role permissions, then employees with 20-minute training on autofill phishing risks. Enforce extension on corporate browsers; block mass export except documented break-glass.
Policies: unique generated passwords, MFA on vault, offboard
Policies: unique generated passwords, MFA on vault, offboarding revokes same day. SSO integration where it exists — vault covers what SSO does not (legacy apps, vendors without SAML).
Common objection: "what if the manager goes down?" — hence break-glass in offline storage and MFA on master account. More risky is reusing Password123 on twenty services because "nobody will hack a Bayamón SMB." Spoiler: they will.
Culturally in LatAm personal trust replaces process. Password manager is not distrust — it enables collaboration without leaking credentials via WhatsApp. Productivity rises when they stop resetting forgotten passwords weekly.
Operations and execution — connecting strategy with what the team ships every week.
