Passbolt Usage Policy

In this article:

Policy Brief

---

Passbolt is a password management tool that can help you to remember and manage all your password. All password for work related account should be stored on passbolt. To ensure correct usage of Passbolt, we are enforcing a few rules of what credential can be put into Passbolt.

Scope

---

This policy applies to all crews (full-time, temporary, and interns) that use Agate’s Passbolt service.

Policy Elements

---

Passbolt Passphrase Criteria

The passphrase criteria on this policy is enforced for the password used to access Passbolt account. For password criteria for other account, you can refer here: Password Creation

Passphrase criteria:

• Strength: Very strong (full green bar)

  • Open Image

    

• Use 16 or more characters for your password.

• Use easy to remember sentence (use slang is preferable)

• Use at least one number for each word in your password to mask the word. E.g. hello → h3ll0 (two or three number is good)

• Use a combination (at least one each) of upper case, lower case, and symbol for your password. The more unusual symbol, the better (e.g. # % & @)

• This is the example of passwords using the above criteria:

  1234567890123456
  hey!janganlupaya
  kukuk4k1kuk4ku!!
  j4ng4nt4ny4k4p4nn1k4h?
  sp0nb0b&p4tr1k??
  0hay0ugoz4im4su!
  

• Other option is to use random gibberish sequence of letter and number, and also at least 1 symbol. This is the example of passwords using this criteria:

  dfghjk87654CVBNM!
  ZXCV!@#$7890VBNM
  qwertYUIOP!@34567
  

Credential Type

What to put on Passbolt

1. Agate Office365 account credential
2. All account credential that is registered using your @agate.id email. This may include Unity account, App Store account, Agate Google Account (registered with this SOP [How to Create Google Account with Agate Email](How to Create Google Account with Agate Email 3d54e114a41b4204b0d596c7669e5e66.md)), etc.
3. All work related account credential that does not use email, e.g. using Username or Id to log in. This may include Agate Website Wordpress account, GoDaddy account, etc.
4. Work related account credential that is not registered using @agate.id email. This may include Gmail account for QA purpose, etc.
5. Any other work related account credential that may not be included in the points above

What NOT to put on Passbolt

1. Personal Gmail account credential
2. Personal Facebook account (even if it was used as facebook login on business.facebook.com)
3. Personal gaming account
4. Personal bank pin
5. Any other personal and non work related account credential

Credential Sharing

• When you need to share account credential to other crew, please use Passbolt password sharing feature. By sharing via Passbolt, Agate can track which crew we have shared the credential with
• Do NOT share credential via copy pasting, Teams, WA, Email, etc. This can be intercepted and commonly compromised
• If you have a team that need the same credential, please create a group for your team. You can then share the password to that group
• The detail for how to use Credential Sharing can be found here: @ passbolt SOP

  • Alternative documentation

    https://help.passbolt.com/faq/start/share-password

Password Rotation

Password rotation means changing/resetting password to a new one.

• Crew need to rotate their password every 3 months. Crew can see the list of credentials that haven’t been changed more than 3 month ago in Passbolt.
• Please do not reuse your 10 previous password when changing your password.
• When a crew move to another team/division, please reset your team/division specific credential.
• When a crew graduated, remove their credential access.

With the benefit of password sharing feature, all crew that have the shared credential will get email notification on password change via email. They also automatically get the new password updated on their Passbolt.

Related Pages

---