1

I am looking for policies/guidelines for businesses that have administrators for passwords for necessary websites so management can access administrator rights in case of emergency.

5
  • 2
    Please elaborate and give examples. Also, is this a real-world need you have or is it for academic study? Oct 11, 2016 at 20:14
  • Just like this website. It required a password. I am the only one that has it. I am researching for upper management. I am looking for a policy for securely housing passwords to websites that are for mutual company purposes. I also administer a website for all employees to give them access to a City Agency where status of our projects and input is necessary. So if I don't ever come back to work after today, the company would not be able to add or remove access for the employees. So I am looking for guidelines to work from for a policy to collect these types of passwords.
    – Admin
    Oct 11, 2016 at 20:22
  • 1
    The examples point still stands. For example ( :) ), are you starting from zero? i.e. right now, is there a password policy? Half of a password policy is its implementation, and moving from one password policy to a new one is part of the implementation of the new one.
    – grochmal
    Oct 11, 2016 at 20:29
  • 1
    It sounds like you're looking for a "password manager" or "password vault" product. Although I'm not sure if you want product recommendations or just policy language you'd use to implement alongside a solution like this. You may want to do some research on these and update your comment if you need more specific guidance.
    – PwdRsch
    Oct 11, 2016 at 20:40
  • Many vendors provide use cases, whitepapers, and feature lists. Most (All?) business pwd managers provide some form of user (person/employee) account, shared (project, client, limited subscription, site) account, roles (pwd admin, project admin), privs (read-only, checkout), and emergency ("break box/glass", death) access to at least shared accounts (e.g., 2 of 4 preselected people agree, possibly after waiting period &/or email/text notification). Some products allow pwd admin access to every stored pwd except usermasterpwd; others have segregated "personal/home" vaults.
    – BillR
    Oct 12, 2016 at 0:05

3 Answers 3

1

A personnal password should only be known by one person. This in the one of the holy rules is security, and not respecting it might cause more harm that help.

That being said, in one key action is only allowed to one single account, an old but still valid usage is that the account owner writes his credentials on a paper, puts it in a sealed enveloppe and deposits the enveloppe in his company safe. That way, if for any reason, the company needs to use the account when the normal user is not available, it is enough to designate a new account owner, give him the enveloppe and ask him to immediately change the password and deposit the new one in an enveloppe in the safe.

Never underestimate the good old physical ways...

1

In business context, the expectation is that any website/application should allow multiple equal top-level users (admins) over all the content. Admins should be able to disable each other. Admins shouldn't share passwords (credentials).

The vault comes for these deficient apps which require a single top-level password. If it's a software implementation of vault, I would propose this practice:

  • The single password should not be shared between multiple people.
  • The vault should not show a password to humans.
  • When using the vaulted password, admin is required to go trough a vault software.
  • The vault software logs into destination app automatically and the first thing it does is it automatically changes the password to a new auto-generated one (this requires a quite complex vault-to-app integration).
  • The human then acts inside application.
  • The vault software displays the information "password checked-out by admin jsmith at 10:55" and disables the entry to app.
  • After a configured time or on human request (any admin), the vault automatically logs off the current session (or otherwise stops the current admin's interaction).
  • Optionally, the vault could log in and auto-generate a new password, say each month, even if nobody used it.

Unfortunately the vault integration is not possible for some uses like a Linux root password. In some critical cases, Linux requires the root password to be entered on the physical keyboard - it's quite impossible to integrate without revealing password to humans. So this requires substantially weaker procedures, like proposed by Serge.

0

Have a look at hasicorp's vault. It can be made to only unseal if a minimum amount of people enter their keys. When unsealed, you can manage your secrets, and seal it again afterwards. If you are more into having one person full access, put the important stuff in a plaintext file and encrypt it with RSA. Print the password-protected private key on paper and tell your boss the password. If you were to get hit by a toilet falling from space, the boss would input the private key on a computer, use the password you told him to remember to decrypt it, and then use the decrypted private key to decrypt your plaintext password file. Using your public key you can update the file safely at any time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .