Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am leading a small team at a start-up and I am facing a dilemma with high value passwords.

I am the only one on the team who knows all the key passwords for production servers, databases ... etc. If I get run over by a bus the rest of the team has no way of getting back into all these essential services.

What standards exist for processes around deciding who should have access to high value passwords and how is it communicated and stored? How have you dealt with this issue on previous teams / start-ups.

The application we are working on stores financial data, thus my interest in "standards".

Update:

To answer some of the questions in the comments:

  • All Servers are RedHat Enterprise Linux
  • App Server is tomcat
  • Database is postgres
  • Datacenter is SSA16 certified
  • Dedicated Servers
  • Every server has three separate physical networks it is part of, production traffic in one one nic, backups on another nic, and server management on another nic.
  • High value passwords to secure Linux Server Passwords, SSL certificates, passwords for JKS files, passwords for development infrastructure and deployment infrastructure such as SendGrid,stripe,Jira,source control, ... etc.

Update 2:

So far the answers are all suggesting ways of solving the problem, but are there are any standards backed by some standards body about how to do this? I will keep this question open in hopes of some one being able to name specific standards.

share|improve this question

migrated from stackoverflow.com Oct 14 '12 at 23:43

This question came from our site for professional and enthusiast programmers.

    
Are most of these things on Amazon? –  j_mcnally Oct 4 '12 at 17:16
    
Nope they are at an SSAE16 certified data center on dedicated hardware, with separate production, backup and management networks. –  ams Oct 4 '12 at 17:21
    
Are all your servers are linux machines and you just want to secure application password or only server access password –  aravind.udayashankara Oct 4 '12 at 17:31
    
More of a crazy idea than a standard, but have you considered storing a physical copy in a safety deposit box in a bank? –  Douglas B. Staple Oct 4 '12 at 17:34
    
That indeed is crazy Doug :) –  Woot4Moo Oct 4 '12 at 17:37
add comment

4 Answers

So in the vein of standards, the fact that you have all of the credentials to all of the systems is already a giant red flag (unless you are the only person on the team). Now I understand it is a startup, but just mentioning it as your company grows. Moving on, what should happen is there should be an administrator (different person for each system) that has the credentials for that specific system, along with a separate person who has the ability to restore/reset that password in the case of breach/ lost password. It is important to keep these people separate and to enforce password as well as position rotation. So this quarter I am a software engineer, next quarter I am a DBA, etc. Forcing an admin password change each time.

Basically what you want is a clear separation of duties for each person responsible for administering a system, this will also help to mitigate the concept of insider threat (not completely remove, but it allows for better 'tracking'). This type of thing is generally laid out in a policy that has to have teeth (enforceable and have repercussions including termination).

If the question is how to manage these passwords in a secure way, in terms of storage on hardware let me know and I will make efforts to answer that.

EDIT

Another potential solution is to generate a random administrator password daily and distribute it to the proper people via an encrypted email, this will also reduce the exposure of the systems to insiders and outsiders.

share|improve this answer
    
Our team is not big enough to have complete separation of duties between everyone involved. Also different members of the team are specialists for example front end development, and would not know how to admin a postgres server. I am a co-founder major shareholder in the startup and generalizing specialist. I am interested in secure storage management of these high value passwords. –  ams Oct 4 '12 at 18:00
    
@ams completely understandable which is why I added the caveat in the beginning about team size. Now just because they are a specialist in the area is no reason why they shouldn't have their jobs rotated. Often times you will see people leave because they are no longer being challenged and/or they are bored with the work. Job rotation will also help you for when the specialists leave and someone else has to take over as now more team members have a bigger picture of the whole system. –  Woot4Moo Oct 4 '12 at 18:01
    
As an added I have had the "joy" of implementing these types of procedures. –  Woot4Moo Oct 4 '12 at 18:05
add comment

For maintaining Application passwords , I had come across an open source tool called CorporateVault . It is a multi-user password management web application designed for organizations to store passwords. Written in Grails, Groovy and Java.

It is a good tool to use for managing passwords

share|improve this answer
    
I don't think 128 bit encryption is that good these days. –  Woot4Moo Oct 4 '12 at 18:03
add comment

In companies I have worked at, they have given me access to a website where I can login using my Active Directory password and request a password for any server. If my login is cleared for that server I see the password in plain text, else I would receive an unauthorised error message.

You could also use some third party password management software, a quick google will return results such as Keypass.

http://keepass.info/

share|improve this answer
add comment

One approach is to write down all the passwords and store them in a physical safe. If you have an admin or accounts person, they area a good choice to manage these. If you are run over by a bus, they can make the passwords available to your replacement. Another possibility, considering your position as a startup founder, is to give these to your lawyer or accountant, or maybe your wife.

You ask specifically about standards. ISO 27002 would be the first place I'd look for information on this. I just had a quick look and couldn't find anything specific. One consideration though is individual accountability. Rather than give someone your password, you should create separate accounts with the same privileges (and a different password) - and keep those second accounts safe.

A risk with this approach is that you are placing complete trust in someone. Your wife or accountant could take complete control of your servers. There is a technical solution for this called secret sharing. You could, for example, give three people parts of the secret, and arrange it so that any two of them can combine their secrets to recover the passwords. However, this is probably more a technical curiosity rather than a system you actually want to use.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.