Security reporting in the admin console will identify users relying on weak or reused passwords, and organizations should consider forcing those users to reset their master passwords, LastPass said.Ĭritical credentials saved in shared folders accessed by users relying on a low iteration account, the number of rounds performed during the client-side encryption process, must be rotated. And prohibit the use of previously used passwords.“Remember that length wins over complexity,” LastPass said.Īdministrators should set policies that require: The longer the master password the better, particularly when all available character sets are used.

Usernames and master passwords, which create a unique encryption key, should be at least 12 characters long, according to LastPass. Here’s the most high-level actions LastPass shared with its business customers in a top-down order to prioritize response (advice for individual customers can be viewed here ): Master Passwords Business administrators need to assess their organization’s risk across multiple components and heed the recommendations LastPass said it shared last week in a security bulletin with about 100,000 business customers.

Lastpass teams pricing