This Week’s Question

After finishing my annual Saba Compliance training I was thinking about why doesn’t UConn Health have a master license for a password manager that all us employees can load onto our phones to use to help make our systems more secure? I use one for home use, and it comes with an extension for every type of web browser. We have the Duo Mobile for when I have to remote into my desktop or log in with my NetID to make sure I am who I say I am. It would be nice if it had some sort of password function, to create and store very complex passwords to prevent any sort of hacking.

We do appreciate it’s a challenge having so many systems/passwords. As our CIO Rick McCarthy reports, our information technology and cybersecurity teams have actively researched several leading commercial solutions and fully recognize their clear security benefits; Rick’s group has worked to reduce the number of passwords by integrating systems into our Active Directory authentication (e.g., computer login and Epic have the same password). However, rolling out an enterprise password manager at this scale has proven challenging for reasons related to cost, training and support, technical capability, and HIPAA compliance.

So the bottom line is, we’re not there yet. Rest assured, strengthening authentication and reducing password-related risks remains a high priority. We continue to actively monitor the market for solutions that better balance security, usability, cost, and supportability.

Thank you for your patience and understanding, and thank you for raising this.

---

 

Do You Have a Question for Dr. Andy?

Dear Dr. Andy is a forum to submit questions about anything. In addition to a personal response back to you, questions and answers may be posted on The Hub’s homepage or in other forums. You can choose to remain anonymous by not including your name, department, and email.

Questions selected for publication will not include the submitter’s name and email, and may be edited for length, style, and grammar.