Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is the best practice password policy to use in this situation? The policy needs to accommodate many accounts on other sites (say, more than a dozen), as well as how the passwords are shared among team members (and changed if members leave).

Edit: To response to this.josh's comment, as I mentioned, more than 10 third-party accounts. Most of the accounts are standard password-protected accounts where there must be one for the whole team (these are services associated with the website as a whole, like the Amazon Affiliates program or reCAPTCHA). The services provided vary, few are critical, but they are still important to protect.

share|improve this question
    
How many third party accounts do you have? What type of account controls do the third parties provide? Are you only allowed one account per third party website/service? What capabilites do these accounts provide: functions critical to your website, ancillary to your website, data backup, databasse services? –  this.josh Jul 20 '11 at 23:11
    
If you want to give access to specific people to specific passwords and keep track who has access to what I'm afraid there are no free solutions. There are few enterprise password managers: Hitachi: hitachi-id.com/password-manager or Passwordstate: clickstudios.com.au –  Hubert Kario Jul 21 '11 at 8:53
    
As Hubert Kario mentioned, Passwordstate by Click Studios will provide the functionality you're after and it is FREE for up to 5 user accounts, with no time limits. –  user3576 Jul 24 '11 at 8:28
    
Hi @Mark, welcome to the site! Please see the FAQ wrt disclosing your affiliation with a product. Aside from that, answers are intended to answer the question, please see How to Answer. Hope you stick around and share some more info! –  AviD Jul 24 '11 at 8:44
    
@jrdioko, can I assume you were not asking for a list of products, but rather how to form a relevant policy? If so can you please edit the question to emphasize that, as all 4 answers so far have done just that. If it is what you wanted, this should be community-wiki (any moderator can do this), as that would be a "shopping question". –  AviD Jul 24 '11 at 8:46

6 Answers 6

up vote 6 down vote accepted

I would highly reccomend using a variant of keypass. I use keepassx, it will allow you to keep a local repository of all of your passwords and sensitive information encrypted and accessible to all of your team members.

I have been using keepassx at work for about a year now and have had no complaints.

share|improve this answer
1  
I just looked at KeepassX and some things look a little outdated, is it still under active development? –  jrdioko Jul 21 '11 at 5:12
1  
Yes, it is actively under development. The software is on its way to its second major release, here. –  Chris Knadler Jul 21 '11 at 6:02
1  
KeePass works poorly in a multi-user setting, since only one person can add or edit passwords at a time. –  Christian Davén Aug 23 '11 at 8:08

I suggest Secret Server. Auditing is built in. It will also remember when the password was changed last, and it will remind you when a preset time is up (I.E 30 days) Also you can use roles to choose who has access to certain passwords.

share|improve this answer
    
The auditing functionality is essential (IMO) –  Rory Alsop Jul 22 '11 at 7:38

Meldium recently popped up on my radar. One unique thing is that they can automatically provision a new user when you onboard a new employee giving him/her access to all that they need.

share|improve this answer

I have to revise my comment. There are solutions for password management and sharing: Passpack for small groups it's cheap (4$ a month).

Unfortunately it doesn't provide auditing and doesn't remember when the password was last set.

share|improve this answer

We had exactly the same issue, and decided to build Pocketvau.lt (-> https://www.pocketvau.lt). This had been a pain point for us for quite a few years and existing solutions just didn't solve the issue in a way that we were comfortable with.

(Full disclosure: I'm the founder)

share|improve this answer

I'm a big fan of CommonKey. They allow you to group users into teams and share accounts. I think it's free for up to a handful of sharing too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.