I work as the primary developer and IT administrator for a small business. As a result, there are a lot of things that I need to ensure are documented and readywant to ensure thethat business keeps functioningcan continue even if something goes wrong and I amsuddenly become unavailable for some reason. AlotMuch of the thingswhat I do require that anyone stepping into my role haverequires access to a number of servers, (through key based-based ssh), cloud services, and other secure infrastructure of applications. Some of these services use MFA, either using dedicated MFA apps (like amazonAmazon) or using SMS.
How do I want to ensure that my "hit by a bus" plan and documentation, is complete and comprehensive, but that this documentation doesis not itself create a security risk.?
The documentation will be hosted on a shared file server behind our VPN, but that can also be accessed using a third party web frontend that puts a "DropBox" like-like interface on top of the base file server (iei.e. authentication, desktop syncing, file sharing, etc). The files are in a location where only I, and other file server administrators can see them.
What's the best way toHow should I manage the "secrets" (passwords, private keys, MFA access) in this documentation to ensure it remains comprehensive without compromising security?
Note: I already have some ideas that I will explain in comments if desired, but I wanted to leave the question open-ended to get ensure I didn't exclude any possible approaches.
