It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of):
What is the most secure way for a batch script, a program needing to connect to a resource (E.g. database) via a non user driven interaction to authenticate? Technology agnostic answers are best, but if there is a big different based on the OS (Windows, Unix, Mainframe etc), database or program language that is also useful to know.
It would be good if you can state why the solution (or options in preference order) is secure (e.g. it protects against malicious internal users, external attackers, malware in these ways). Also why it has a low operational impact (change, maintenence etc).
E.g. my list:
IMO best preference (most secure) to least:
- Certificate based authetication where the cert is stored in a HSM
- Certificate based auth where the cert is stored in a software crypto module
- Certificate based auth where the cert is the certificate store of the OS -- generally needs root to get access so game is up if this occures
- Externalised authentication based on an LDAP
- Password based where the password is encrypted and stored in a different server or password vault. Only service account is authourized to connect, decrypt and retrieve the password over secure transport (basically how TDE works with Oracle Wallet)
- Password based where the password is encrypted and stored on the server. Service account can decrypt only.
- Password based where password is stored on the server but protected by OS perms and is excluded from backup (manual backup in password vault).
Certificate is best by far and the defacto method for anything like Amazon EC2, Github etc.
Please close and redirect if this is answered already. I couldn't find it when I searched.