Video Gallery

User Management and Security - Best Practices

Go to Video Gallery Added May 19, 2021 •

Copy this URL:
Embed code:	<iframe class="edlio-embed-player" type="text/html" width="640" height="360" src="//help.edlio.com/apps/embed/?v=318538" frameborder="0" allowfullscreen></iframe> Change dimensions

Go HD

Check out this short webinar where we go over best practices for keeping your school site as secure as possible. We take a look at the built-in tools included with your Edlio website that you can use to ensure your site is protected from unwanted attacks.

Show Transcript

now people at it is time to talk user management and security now more than ever it's important to focus on keeping our information safe and secure now while Edlio prides itself on its website security and maintaining a safe platform for our wonderful clients we do need your support in sustaining that level of security on average 30,000 new websites are hacked each and every single day and I am sure many of you are aware that school websites are increasingly becoming targets of these attacks let's go over some ways that you can help keep your school website and by extension your school Community safe from these unwanted attacks so today we're going to be talking about a password security sorry folks a password 1-2-3 or a 1 2 3 4 5 6 7 8 as your password will not cut it you'd be surprised at the number of weak passwords we were still seeing floating around out there before we strengthened our password requirements so we'll go over that our new password requirements updating your password we'll go over single sign-on options and how you get that implemented for your school I will go over user access best practices and finally we'll go over some of our new security features here including two-factor Authentication alright now Iet's see here we go now a strong password is your first line of defense in keeping your site safe and secure if you're using an easy to remember passwords than odds are it can easily be guessed slash used by a hacker or malicious actor they're not going to be sitting there manually typing away numerous password to gain access they're going to be using a program to cycle through commonly use passwords and odds are those passwords can usually be guessed within seconds so just a quick you know I am hoping nobody here has any of these as any of your passwords but the top five most commonly used passwords right now are number one at 1 2 3 4 5 6 number 1 2 3 4 5 6 7 8 9 numbers 3 picture1 Number 4 is just password and number 5 is one two three four five six seven eight I know I am sure our wonderful clients know that that is just not going to cut it these days up I just wanted to throw that out there those are the top five most commonly used passwords right now and I think we can all agree that needs to stop so I also understand it's a convenient to use one password for all sites slash accounts that you access on it saves you from having to remember a million different passwords but that's also a terrible idea once a malicious actor finds your password they're going to try to use across multiple platforms / site so creating a strong and unique password for all your sites it's a simple and practical way to keep unwanted Intruders from accessing your accounts here you can see I've included a couple of password examples very similar obviously as we just said don't use that top password honestly don't use any variation of password in your password even for examples sake don't even use this but we'll get into that in a second here but we can see here are the colors down below these indicate just how strong these passwords are I'm surprised it even has a yellow I think it's probably more of a red here but we can see this a bit more yellow here and a green for the strong password now this bottom example has symbols numbers upper and lowercase letters I recommend staying away from any variation of the word password in your password but just wanted to give you an example for showing you how you can come up with something like a word or phrase or something that you can remember subbing in symbols numbers to differentiate and make it more difficult to crack now we also recommend using password managers / password generators to come up with something strong you know we see a lot of customers using a one password and LastPass. They're both great great option actually came up with this here through last pass here for these password examples showing you just how strong they are both options very easy to use and make your accounts so so much more secure 10/ 10 definitely would use again I use last password actually when I I'm making accounts you know for for new users or something you know if if I enter a password for them I'm going to go ahead and use LastPass here because it can create some really strong passwords for you so I'm definitely recommend using that if you're looking to create a a strong password for your site now we just created some new password requirements here most sites here will require that you use some form of these but in this case we're asking to be at least 12 characters at least one symbol at least one number and at least one uppercase letter we ask that it does not contain your name your username or your school name anywhere in the password we also ask that it not be a commonly used password or contain any dictionary words okay now if you have a weak password something that's not going to cut it anymore you will receive this message on your login screen weak password detected passwords that do not meet complexity requirements are blocked to ensure that your account is secure and you can easily reset your password by clicking that little reset your password link there and following the instructions provided I will even show you here how we can go in here if you ever want to update your password you know you're like we recommend changing your password like you know every couple weeks every couple months if possible keeping it updated regularly so in your admin site here if you go up to account profile up here top right you can change your password you just need to enter your current password and then the new password and retype that new password pretty easy to do again try updating it every couple of months just you know for for security sake here all right now getting back in to our slides we are going to SSO now besides our standard login options your school or District IT Department can also set up integrations with Google Office 365 or active directory or LDAP a single sign-on platforms now once set up users will be able to login to your admin site using their SSO credentials which is great because it's one less one less password to remember so we'll get a little screen like this if they're using Google SSO this is what it will look like they clicks sign in with Google and then they will be able to log in using their Google credentials as if your school is again this works for Google or Office 365 or if you have an active directory setup we can do that as well so if your school is interested in setting up SSO please reach out your client success Specialist or to our support team for more information on getting that setup Now why should we use SSO? Now first off it allows staff to sign in again using into your admin site using their own Google for Office 365 credentials which means one less password to remember that's pretty good it also offers two Factor authentication so in this case they'll be using a Google or Office 365s own two-factor authentication which is pretty great and actually something will be getting into here in a second as Edlio as moving towards two factor authentication ourselves it also helps simplify your user management process It uses password requirements set in the SSO platform so whatever Google Microsoft password requirements are it'll be a through them it will not be through us if you are using an active directory ldap your passwords must still meet Edlio's password requirements so that's only if you're using an edlio only using an active directory you'll have to use Edlio's password requirements alright so let's get into some user access best practices now we're about to hop into the admin site here to see how we can perform some of these tasks here Changing gears I'm just going to cover some best practices when it comes to granting users access to features of your website with security in mind it's a good idea to limit the number of users with website administrator access while it may be more convenient to grant a user full web admin access well which gives them access to every feature of your site the more web admins that you have the more opportunities / targets malicious actors have have to gain access to your admin site we recommend auditing your users with website admin privileges regularly to ensure the only people that need those privileges have them. So let's hop into the admin site here and see how to do this. Give me just one moment here to open an admin site with a super admin account So now I am logged into our admin site here I'm using our super admin account remember which for every site is going to be the username admin so if you want to login to your super admin account use the username admin and remember the only difference between a super admin and any other website admin is that the super admin has the ability to grant or revoke webmaster privileges to users So to get to our user management we are going to come down here to site management and user management okay so we see everybody here up top under website administrators these are all the people that are able to come in here and edit our website If we come down here to regular users you can see these are regular users they will have access to their teacher pages their personal calendars a personal photo album but they really won't be able to do too much unless they're given a specific individual privileges which will get into in a second now let's see here let's see okay So up here let's say it's the end of the school year and I come in here and we have too many people to have full access to the site for Security's sake I want to take some of these privileges away not all these people need to be able to edit the entire site I am going to take one account here we'll go to my own account here Daniel Benson so in order to go ahead and remove these website admin privileges I am going to come in here to Edit Profile and see right here I have website administrators selected here I am going to go ahead and uncheck that if I click save down here I removed here from the website administrators here I am down here with a regular user so I will not be able to edit anything in the website now another best practices I wanted to share is only granting access to features a user will need so we'll come back here to the Daniel Benson's profile being a web admin it is tough it's a lot of work we definitely encourage bringing in assistance wherever you can. We're all about teamwork here at Edlio you know big proponents of teamwork makes the DreamWork. A lot of web admins will often bring in teachers or support staff to assist with this challenge updating the site let's say you have a staff member who has agreed to update your news and announcements on your website it's a pretty important job getting the news out to the school community. Now your school community let's also say they utilize the School News App again pretty important that this person is able to do this but if that's all they're going to be doing aside from editing their own personal teacher pages we don't need to give them a full admin access to the site so what we can do here is give them individual privileges. So I'm going to go in here to Daniel Benson who is now just a regular user not a  web admin, edit profile alright then so I can come down here and give this person edit access to this let's say specific pages and said here. I want to go ahead and give them access to edit our news and announcements so I want to come here to news categories news and announcements check that off so when they login next they will just see that news announcements at editing privileges aside from all their other editing privileges that their able to do individually like their teacher pages, photo albums what not. They will be able to just edit news and announcements from an admin perspective. All right and then as we are coming down here to we also recommend throughout the year especially at the end of the school year, kind of taking stock of just in general who is still at the school so let's say you know at the end of the school year you have some turnover some teachers leaving the schools for some new opportunities so let's say we want to remove this user from our user management so they can no longer log in and they will not show up in the staff directory so we have a few different options here at the bottom under account options so the first one is disable if we select that that means the user cannot log into the school admin site they cannot be seen on the staff directory their personal Pages cannot be seen on the public site their user data and personal pages will still be available in the CMS you can access whatever data you need to from that. The next one we have here is locked out the locked out is like a disabled user user cannot log into the school admin site they are still seen on the main staff directory and their personal pages are still there on the public website but like a disabled user and like a disabled users that user data and personal pages will still be available on your school admin site and the last option you have down here delete you know that's just if you want to get rid of everything so this is permanent. All their data all their personal Pages everything will be immediately deleted cannot be retrieved so only do that if you know you know this person is gone or not coming back and you know we don't need their personal Pages or anything of theirs so we can delete them there. In this case Daniel Benson is still very much a part of the school now he's a regular user not a website admin here but we're still giving him edit privileges here to edit our news and announcements so I am going to go ahead and click save. Alright so we have everything we need there So actually while I am still here in user management let me show you where we can generate a password reset for a user so I will come back down here to this account click on their username here at the bottom of the screen you will see a button that says email password reset link clicking that button will generate a password reset email to that user please please keep in mind that this will lock out the user until that password is reset so this feature is only available to website admins remember I'm logged into the Super admin account right now all right now the last little bit I wanted to go over here with you today was two-factor Authentication now this is the latest upgrade to further enhance the security of your sites in 2 Factor authentication also known as 2fa or MFA for multi factor authentication. Now 2FA is a method of providing two different pieces of information to allow you to log in more safely we provide an app based two-factor authentication that you can register from your user profile page these are these are just a few of the authenticator apps that we recommend using here we have Authy from Twilio, Microsoft authenticator and Google Authenticator that is one I use really like it now if you want to go ahead and get two-factor authentication enabled on your on your user profile here Let me show you coming here actually log into login to dbenson's Let's see any others with bicycles All right, so I am logged in now. Right here you're going to see front and center since I have not register two-factor authentication I can click right here register two-factor authentication I can actually also come up here to your account profile enable two-factor authentication there. Now actually running a special right now so if you go ahead and enable two-factor authentication and then email your client success specialist by June 4th 2021 and let them know hey so and so I have enabled two factor authentication we will go ahead and send you some free Edlio swag we got some cool stuff going out in the mail there again we really want to make sure our websites are as secure as possible so we definitely recommend getting that to a two-factor Authentication enabled as soon as possible and remember when you do that if you do it by June 4th 2021 and reach out to your client success specialist to let them know we will go ahead and send you some Edlio swag. So okay once you click that enable two-factor Authentication you will go ahead and let me show you here you will get a QR code that looks just like that to register your two-factor authentication so you are going to scan it using one of these authenticator apps on your phone then enter the code provided by the authenticator app into the PIN code down here into that field and tap register two-factor authentication you have now successfully registered your two-factor Authentication you will now be asked for your two-factor authentication code whenever you sign in so make sure that you have access to a your authenticator app before you sign in because you will need that code to login successfully all right I think that'll just about wraps things up for today.

Listed in My Edlio Webinars

Video Gallery

User Management and Security - Best Practices

Popular Videos