What is the best way to hand out passwords to a widely spread diverse employee base?

Question

I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.

I've thought of some options, but there are drawbacks to all:

• Email: insecure and travels in the clear, unless it is kept internal to the company. However, some mail is forwarded outside the company, and some user access from the Internet is no doubt done with unencrypted access. In any case, not all have email access (e.g., contractors).
• "Briefcase": I could add the password to the user's Zimbra briefcase, but this suffers from most of the same problems as email.
• Telephone: Problem with using the phone is that VoIP can be tapped and is, I believe, generally unencrypted (though I don't know). It is also possible that the recipient is using VoIP and whether it is encrypted or not is unknown - in fact, the very nature of the receiving phone is unknown. In any case, some user's are in a time zone 12 hours off from ours - so this is out for the most part.
• Encrypted Email: I hesitate with this one as it includes user education, but it may be the best way. Also, it means handing out keys somehow. There is also the email client support issue: users mostly use Outlook, but there are users using Gmail, Hotmail, Evolution, iPhone Mail, Apple Mail, and the Zimbra web interface, among others.
• Web Portal: With this, users could access a web page inside the company or over an encrypted link and get a password (or perhaps, request one as well). I'd have to set this up (not a problem: I'm a programmer and administrator in one...) but it still requires handing out a password for the VPN or to log in the first time.

Here are the problems that have to be overcome, in a nutshell:

• User education
• Unencrypted traffic
• User access
• User timezone differences
• User location differences

My inclination is that I'll probably wind up with some form of encrypted email and/or web portal; for now I'm using a mobile phone.

EDIT: The big problem here (as in all encryption methods) is in getting the initial password or key to the source. In particular, there needs to be a way to identify the originator and to prevent disclosure of the key. The problems we face in preventing disclosure are the following:

• User workstations are not all on central network
• Some users are isolated (work at home, etc.)
• Some users are international: 12-hour time difference
• Many users are not even employees, but contractors with sister companies or with outside vendors

I wonder if I'm just going to have to accept some risk.

Answer 1

I would think that your only real way around this road block is with a pre-issued two-factor token, and an email with a one time password that has to be reset to the user's new password upon first login.

The one time password would be of no value without the two-factor token.

Answer 2

Have a sub-administrator at each office location, and set up administrative procedures and a proper toolchain with these local admins.

It's the only really scalable and flexible way. The on-site admins can verify the users identity in person, and educate users on practical matters like password policies. And the local admin will gain familiarity with the tools you're using, so with a bit of training they can often use the platform tools (i.e. Active Directory, LDAP) directly.

A local admin like this doesn't need to be a technician. A centrally placed secretary, office manager or other administrative profile with good people skills and a methodical approach to things is often a great fit.

Answer 3

Maybe another solution would be to provide the credentials via an established secure channel, e.g. send a secure mail to the boss of the employee. This of course means that the password has to be changed immediately upon reception. For contractors, they would have to check in to a local associate.

Answer 4

The system needs to allow them to set up their basic profile information themselves.

The only other secure method is either a pre-configured two factor authentication (2fa), or by hard-copy print (my bank will only send my pin number by post and separate to any other linked data). There is a reason for this.

I'm concerned by @DavidStratton's comment about a password retrieval system. That sounds worryingly as if you have stored passwords in plaintext and built an automated password delivery system.

Answer 5

Using email to deliver passwords is only an effective solution if you're not sending out the password used to access the email account.

Anything other than having the email written down (i.e. telephone in your examples) and you've got all the fun of explaining which letters are capitals, what's a punctuation mark etc.

SMS or a bit of paper or the only practical solutions if you really want tight security. But if you've created the account and know the users email address then it's possible that you will also be able to capture a secondary authentication token (which can be used for account activation rather than having to present it every time for access).

Certainly any password you issue by such means should be temporary - i.e. time limited and only allow access for the user to pick their own password.