Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can look at promising the end of password pain. These passwords are then shared with the company's management - I don't know how that bit works, but they can read the passwords too.

Is this really that secure? I was given two reasons why it is by my boss:

  1. If I forget my password, I can just ask him for my password.
  2. If I turn evil, they can lock me out.

I don't agree with these. For the first one, surely there must be a better way for most of the things we use like Google Apps - e.g. the admin has a reset button. For the second one I can just change my password anyway and not update the password safe.

So am I right that this is not secure? Or is this the only way?

share|improve this question
1  
@AviD I disagree that this is a duplicate question. security.stackexchange.com/questions/5539/… is about a request from an admin to give a password that comes out of the blue; this question is about a company policy, and also introduces the issue of an online safe into the mix. The two questions are related but far from being duplicates. –  Gilles Oct 18 '12 at 17:50
2  
Not to be grim but this policy is showing up in more and more organizations to deal with the fact that you might become suddenly dead –  Mark Mullin Oct 19 '12 at 19:48
2  
I guess you have plausible deniability about everything that happens with your accounts now. –  rox0r Oct 20 '12 at 1:55
add comment

7 Answers

up vote 15 down vote accepted

None of the reasons you've given are valid reasons for escrowing your password. There's only a couple valid reasons for escrowing any sort of "authenticator" information. A couple others have touched on these, but I'll try to clarify a bit.

  1. Encryption Keys: It makes absolute sense for the organization to have access to escrow copies of your encryption keys. After all, the data you're encrypting (provided you're only using your company's encryption for work purposes, of course) is their data in the end anyway. So, they need to retain access to that data in the event you lose your key or you are separated from the company. However, the encryption key should not be the same key you use for digital signatures. Also, they should not have actual access to your authenticator - the passcode you use for the key. Instead, they should have their own escrow key that works with their authenticator to decrypt your data.

  2. Failsafe Accounts: It also makes sense that the organization should have backup copies of credentials necessary to access an Administrator-level account in the event the System Administrator's own account is locked out, or they depart the company. However, the credentials should not be for the System Administrator's own account. They should be for a local system account whose sole purpose is for emergency use. To that end, the account should also never be used for non-emergencies and its usage should be closely monitored and alerted. Traditionally, credentials for accounts like these are sealed in tamper-evident envelopes and stored in a secure, physical vault. It's conceivable that there may be digital equivalents, but I personally wouldn't trust those without a thorough review.

There's two big reasons why it's a bad idea for management to have your password. The first reason is potentially very bad for you, as it could end up causing otherwise unnecessary work for you if things go wrong. However, the second actually turns this around and makes it potentially worse for the company than it is for you if things go really wrong.

  1. Potential For Abuse: The obvious one - managers now effectively have unrestricted access to the systems, regardless of whether they should, with the same privileges you have. Most simply this means that the managers may leverage this to do things on the system that they otherwise should not be doing. This also leaves the potential for them to bypass your position whenever they want to rush a particular change along without following standard procedure.

  2. Loss of Non-Repudiation: Once someone else has your credentials - and, especially in a case like this where it can be proven they do - they can impersonate you on any systems where those credentials are valid. This makes it difficult to definitively prove that any actions taken by your account were actually taken by you. If a manager does decide to use your account, and ends up royally screwing up the system, it won't be very easy to use you as a scapegoat even though your account is in the logs. Worse for the company is, if you do something to royally screw up the system while your managers have your password, they'll have a harder time proving that it was actually you that did it.


TL;DR: There's no good reason I can think of for management to have any of your passwords. As for the reasons they've given:

  1. "If you forget your password..." another System Administrator can reset it for you. Or, management can "break the glass" on the emergency account (see "Failsafe Accounts" above) and do it themselves.
  2. "If you turn evil..." again you can be locked out by another System Administrator, or the emergency account.
share|improve this answer
add comment

The first reason (give you your password back in case your forgot it) is quite weak: if you forgot your password, then it is not a good password, and it would make more sense to let you reset it by choosing a new password. The second reason is totally bogus: if they cannot "lock you out" without knowing your password, then they should fire their sysadmin ASAP. He doesn't know how to right-click.

Most probably, your managers want to have the feeling of being in control and to actually manage at very close range. Possibly, they might just want to prevent the employees from using swear words as passwords because it could offend some deity somewhere. Either way, this does not highlight the competence of whoever came up with that security policy in a very positive way.

Edit: though, the policy would make some kind of sense for passwords which are used for encryption, e.g. when you protect a Zip archive with a password. That kind of password cannot be reset, and losing the password (you forget it, or you become "unavailable" due to having been struck by a bus) implies losing the data. In that case, escrowing the password makes sense. But for an authentication password, no, that's a stupid policy.

share|improve this answer
add comment

No, it is not a good idea. Thomas explained why it doesn't achieve its own goals, but it is worse than that.

Consider what happens when a rogue employee misbehaves causing damage to the company.

During the trial, you are subpoenaed to testify about logs showing that it was the employee who caused the damage, and are asked who else could log in as this employee. You truthfully answer that anyone with access to the safe including all of management could log in as that employee and your logging systems would be none the wiser.

Anything that blurs the distinction between actor and authenticating credentials seriously undermines the company's ability to use access logging to discourage misbehavior or recoup damages.

Managers often hand out passwords to subordinates when an IBAC system fails to explicitly handle delegation, but this is the reverse of that case, where the blurring affects the credentials of the much larger group of lower-level employees.

share|improve this answer
add comment

Agree with @Thomas Pornin on the "bus factor", but there is one more thing to consider: the "online safe" is likely to be not really secure at all. It makes sense to put passwords in writing into a single physical vault, and keep them there so that in case of emergency the vault may be opened with the management's express authorization.

share|improve this answer
add comment

The second requirement is completely bogus as stated. Knowledge of the password is not required in order to revoke an employee/administrator's privilege.

The first requirement is valid, but I would discuss two things with your boss: 1) The company should sign a legal waiver absolving you from any criminal or civil wrongdoing resulting from use of your logon. Since they have required that your logon be shared, they must acknowledge that you cannot be held responsible for your boss surfing child porn sites on your password.

2) The Discovery problem raised by @Mike Samuel. If there is any legal discovery against your company your boss could be utterly screwed. (and you might point out that there is a relationship with #1 - if you are sued or charged for any offense whatsoever related to your logon, your lawyer would be forced to issue a discovery request.)

Low tech password escrow is a relatively normal practice in my industry. We add "Tamperproof/tamper resistant/Tamper evident" to the requirements set to protect both sides.

Write the password (for a single system) on a sheet of paper. Fold it and seal it in a opaque business envelope. Seal the envelope, sign across the boundary. Now apply tape over the signature and the boundary.

Repeat this for each system.

Now insert all the envelopes into a large manilla envelope. Seal the envelope. You and your boss sign/countersign across the seal.

Store that in the safe. This means the business is protected against the bus factor.

Write policy/procedures for opening that envelope and using the password.

Periodically verify that the envelope is unopened (frex, when you do your normal password change)

share|improve this answer
add comment

Depending on the types of information that your credentials provide access to, your type of organization (Financial, Healthcare) or location, there may be regulations (e.g., GLBA for banking, HIPAA for healthcare) in place that require no one have your credentials.

For instance MA 201 CMR 17 (http://www.mass.gov/ocabr/docs/idtheft/201cmr1700reg.pdf) requires that if you have access to certain sensitive info about a resident of MA that you have a unique ID and password to access that data: "Do you assign unique identifications plus passwords (which are not vendor supplied default passwords) to each person with computer access; and are those IDs and passwords reasonably designed to maintain the security of those access controls?"

HIPAA 164.308(a)(5)(ii)(D): Each user has a unique identifier (i.e. user ID and password) when accessing their computer, EHR software, or any other system or resource.

share|improve this answer
add comment

When we create a userID and attach it to a owner, it inherently become the property of an employee [not of course personal property ;)] who is responsible and accountable for all the actions/activities performed under that account until he is employed with the company.

Generally, the Password Policy of every company [except some like yours] suggests 'Not to Share' the access credentials with anyone.

In case you have to, you need declare it as a shared/generic user ['with admin rights' in your case] stating that you have shared the access credentials with Mr.x / Team x and though it is in safety vault but can be accessed upon need by them.

My suggestion to you is to go ahead and give them what they need and write an email to your manager, his manager and Password Safety Vault Manager [person who is responsible to keep a logbook when they access the password safety vault] stating that you are ready with the Password Envelope [sign it across the seal flap] and that they can keep it safe in the vault.

Regards

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.