Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am leading a small team at a start-up and I am facing a dilemma with high value passwords.

I am the only one on the team who knows all the key passwords for production servers, databases ... etc. If I get run over by a bus the rest of the team has no way of getting back into all these essential services.

What standards exist for processes around deciding who should have access to high value passwords and how is it communicated and stored? How have you dealt with this issue on previous teams / startups.

The application we are working on stores financial data, thus my interest in "standards".

Update: To answer some of the questions in the comments:

  • All Servers are RedHat Enterprise Linux
  • App Server is tomcat
  • Database is postgres
  • Datacenter is SSA16 certified
  • Dedicated Servers
  • Every server has three seperate physcial networks it is part of, production traffic in one one nic, backups on another nic, and server management on another nic.
  • High value passwords to secure Linux Server Passwords, SSL certificates, passwords for JKS files, passwords for development infrastructure and deployment infrastructure such as sendgrid,stripe,jira,source control, ... etc.

UPDATE: So far the answers are all suggesting ways of solving the problem, but are there are any standards backed by some standards body about how to do this? I will keep this question open in hopes of some one being able to name specific standards.

share|improve this question
    
Are most of these things on Amazon? –  j_mcnally Oct 4 '12 at 17:16
    
Nope they are at an SSAE16 certified data center on dedicated hardware, with separate production, backup and management networks. –  ams Oct 4 '12 at 17:21
    
Are all your servers are linux machines and you just want to secure application password or only server access password –  aravind.udayashankara Oct 4 '12 at 17:31
    
More of a crazy idea than a standard, but have you considered storing a physical copy in a safety deposit box in a bank? –  Douglas B. Staple Oct 4 '12 at 17:34
    
That indeed is crazy Doug :) –  Woot4Moo Oct 4 '12 at 17:37
add comment

migrated from stackoverflow.com Oct 14 '12 at 23:43

This question came from our site for professional and enthusiast programmers.

3 Answers

So in the vein of standards, the fact that you have all of the credentials to all of the systems is already a giant red flag (unless you are the only person on the team). Now I understand it is a startup, but just mentioning it as your company grows. Moving on, what should happen is there should be an administrator (different person for each system) that has the credentials for that specific system, along with a separate person who has the ability to restore/reset that password in the case of breach/ lost password. It is important to keep these people separate and to enforce password as well as position rotation. So this quarter I am a software engineer, next quarter I am a DBA, etc. Forcing an admin password change each time.

Basically what you want is a clear separation of duties for each person responsible for administering a system, this will also help to mitigate the concept of insider threat (not completely remove, but it allows for better 'tracking'). This type of thing is generally laid out in a policy that has to have teeth (enforceable and have repercussions including termination).

If the question is how to manage these passwords in a secure way, in terms of storage on hardware let me know and I will make efforts to answer that.

EDIT

Another potential solution is to generate a random administrator password daily and distribute it to the proper people via an encrypted email, this will also reduce the exposure of the systems to insiders and outsiders.

share|improve this answer
    
Our team is not big enough to have complete separation of duties between everyone involved. Also different members of the team are specialists for example front end development, and would not know how to admin a postgres server. I am a co-founder major shareholder in the startup and generalizing specialist. I am interested in secure storage management of these high value passwords. –  ams Oct 4 '12 at 18:00
    
@ams completely understandable which is why I added the caveat in the beginning about team size. Now just because they are a specialist in the area is no reason why they shouldn't have their jobs rotated. Often times you will see people leave because they are no longer being challenged and/or they are bored with the work. Job rotation will also help you for when the specialists leave and someone else has to take over as now more team members have a bigger picture of the whole system. –  Woot4Moo Oct 4 '12 at 18:01
    
As an added I have had the "joy" of implementing these types of procedures. –  Woot4Moo Oct 4 '12 at 18:05
add comment

For maintaining Application passwords , I had come across an open source tool called CorporateVault . It is a multi-user password management web application designed for organizations to store passwords. Written in Grails, Groovy and Java.

It is a good tool to use for managing passwords

share|improve this answer
    
I don't think 128 bit encryption is that good these days. –  Woot4Moo Oct 4 '12 at 18:03
add comment

In companies I have worked at, they have given me access to a website where I can login using my Active Directory password and request a password for any server. If my login is cleared for that server I see the password in plain text, else I would receive an unauthorised error message.

You could also use some third party password management software, a quick google will return results such as Keypass.

http://keepass.info/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.