I am leading a small team at a start-up and I am facing a dilemma with high value passwords.
I am the only one on the team who knows all the key passwords for production servers, databases ... etc. If I get run over by a bus the rest of the team has no way of getting back into all these essential services.
What standards exist for processes around deciding who should have access to high value passwords and how is it communicated and stored? How have you dealt with this issue on previous teams / start-ups.
The application we are working on stores financial data, thus my interest in "standards".
To answer some of the questions in the comments:
- All Servers are RedHat Enterprise Linux
- App Server is tomcat
- Database is postgres
- Datacenter is SSA16 certified
- Dedicated Servers
- Every server has three separate physical networks it is part of, production traffic in one one nic, backups on another nic, and server management on another nic.
- High value passwords to secure Linux Server Passwords, SSL certificates, passwords for JKS files, passwords for development infrastructure and deployment infrastructure such as SendGrid,stripe,Jira,source control, ... etc.
So far the answers are all suggesting ways of solving the problem, but are there are any standards backed by some standards body about how to do this? I will keep this question open in hopes of some one being able to name specific standards.