Managing critical passwords and data across a small business with a focus on business continuity

Question

I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness.

I have been trying to make a case for the importance of having a plan for incident response, such as the ability to have critical sign-ins and passwords or other credentials accessible in the event of a security incident or catastrophe (also including documents or procedures containing sensitive information to cover things such as needing to redeploy our environment) or have access to certain critical services or accounts without relying on the availability of specific individuals who own those accounts as we are a multinational team. Currently, we don't have a lot of organization regarding this area. There are accounts with owners that no longer participate in the teams and many instances of "if it breaks, we gotta hope this one guy in insert country here will be available in the middle of the night."

I looked through some options, and password managers seem to fit the bill for at least some of this. A few people recommended KeePassX in related questions but I can't tell if it would be useful for multiple team members and I'd have to research it to see if it's something that would be easily portable. There doesn't seem to be much documentation and parts of their website are down which makes me wonder how legitimate it is. I personally use 1Password and they seem to have a team focused plan that includes an Administrator dashboard to manage permissions and access but lacks auditing options like change/access logs without upgrading to the business plan at twice the cost. Cost is a big factor in any solution as any budget increase (even small ones) is difficult to negotiate at this point, but if there is a costly solution that is hands-down the best, I can pitch it and hope for the best.

Does anyone know any better options?
Am I thinking in the right direction or am I focusing too much on password managers where another solution might be a better fit? Am I creating additional security issues by trying to put all this sensitive information in one spot?
Is it better to consider a physical solution (e.g. buy a safe) even though none of us are in the same location?

My aim is to understand what my options are, which option/service/product best fits our needs, to research how to use the best options and to pitch this final decision to my superiors.

Answer 1

Because cost is such a concern, then you need to be able to calculate the cost of downtime in a variety of scenarios. You need to perform that calculation first, then you can compare the costs of tools and determine if they are "worth it".

You might find out that there is no cost to downtime, even extended downtime, but rather bosses or stakeholders might get grumpy if the downtime was longer than their comfort zone. I've been in small start-ups where this was true.

If there is no cost to downtime, then you have no need to solve this problem because there is no problem. If the bosses/stakeholders will get grumpy, then you get them to pay for the tool that will resolve their grumpiness.

You have two basic solutions:

1. share/store passwords
2. use a tool that acts as an umbrella login service that grants access to whoever needs it

You can put passwords in an online safe, or a physical one, write them down in spreadsheets, etc. This is cheap, easy, and effective. You pay for the security controls to keep the passwords safe from unauthorised access. For this option, you only need to decide on costs, features, and security. It's a pretty basic analysis for you to determine the better course of action. (For the physical safe, who has the combination? You hope that they are available in the middle of the night. If you encrypt a password file, who holds the decryption key? And so on...)

The other option is to have an umbrella service (IAM, Cloud Services Broker, etc.) that can access everything, and users authenticate to this tool in order to access all the accounts that you need. If your team suddenly needs access to something in an emergency, you just tell the tool to change your access levels and you are on your way. This is the most flexible and most secure approach. It is also the most costly (in my experience).

So, you are not missing out on options. You just need to determine the costs of downtime, the comfort levels of your stakeholders, and which of the two options best meets your needs.