Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am from a marketing firm which now has a development team, which i am part of. We have been tasked with finding a few freelancers who can come in and work when either me and the other developer is off, on holiday, ill etc. Now, in these circumstances, we don't want the freelancers to be asking questions all day, and so a Developer Guide was deemed a good idea. However..

How do we manage the password control for these freelancers?

  • Giving them the root passwords to everything we've worked? This choice isn't supported by us.
  • Creating a new user for every website would also be time consuming. Not only that, but paid services or accessing our clients services would also require a new login, creating costs and hassling high profile clients for some logins that would rather not be bothered.

How else does anyone manage passwords for temporary freelancers? Attempt to trust them or go through the hassle of creating temporary logins?

Or is there a 3rd option we haven't considered yet?

share|improve this question

migrated from programmers.stackexchange.com Jun 13 '13 at 0:10

This question came from our site for professional programmers interested in conceptual questions about software development.

    
Keeping in mind that accidents happen what type of damage could a freelancer cause with root access and how would you handle it if it happened? –  Mike Jun 11 '13 at 16:34
3  
Just make sure their last name isn't Snowden. –  Robert Harvey Jun 11 '13 at 17:11
1  
When the proverbial hits the proverbial, what are you going to do without a solid audit log telling you who did what? If you don't set up new user accounts for temps, you may be in for a big nasty surprise. DON'T BE LAZY WITH SECURITY! –  Deer Hunter Jun 13 '13 at 11:28

2 Answers 2

up vote 1 down vote accepted

I know with certain password managing utilities (1Password, LastPass, etc.), you can enable group password sharing, so that you can share the passwords with other members, but not necessarily allow them to access the passwords directly. I'm sure if one tried hard enough that they'd be able to access the password itself, but it is a viable way for you to manage access to the passwords that way.

Adding to this, if you have a freelancer who then leaves, you can change the password at your centralized point, and all other users who have access still will be able to use the new shared password as if nothing changed, and ensure that the ex-freelancer no longer is able to access those secure sites.

share|improve this answer
    
Thanks for the tip about these pieces of software. Due to the fact these allow a centralized and protected set of chosen logins, we can add all the logins we need. The one click login feature in Chrome/Firefox is perfect for the situation and easily re-usable. –  Daniel Sailes Jun 12 '13 at 8:55

In that situation where creating user accounts is prohibitive or impossible (in the case of some hardware devices) my approach is to have the requisite usernames/passwords stored in sealed envelopes (that can't be seen through.) That way they will only see what they need and when you return you'll know which passwords they've seen and so can reset and set up a new envelope for the next time.

Note: - This is only something you should use if you absolutely must by the way, if you can create accounts you always should and where possible your admin/root account should not be your 'user' account - even for yourself!

share|improve this answer
1  
As much as this may be a viable, more physical way of managing this. The idea was to not have to change/create new passwords for services. The passwords used are not root passwords as such, just usually the only login we were given for, say, user FTP access to a clients website. Keeping the noise to a minimum and the productivity to a maximum was our goal :) –  Daniel Sailes Jun 12 '13 at 8:58
1  
It's a case of security vs. convenience. If I was hiring a company to work on my systems I'd expect them to have good security practices in place - but then I know what I'm looking for... :) –  James Snell Jun 12 '13 at 9:25
    
@DanielSailes - please let me know the name of your company so that I don't offer it a contract by mistake. No offense meant, but after your words any prospective client must be running away fast. –  Deer Hunter Jun 13 '13 at 11:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.