4

Question:

I'm trying to figure out best practices for storing authentication credentials for critical company services - hosting services, domain registration services, recruiting portals, etc... To be clear, I'm not talking about API authentication credentials (those are stored and made available to our code base using best practices), but administrative access to the actual accounts themselves. As a randomly chosen example, imagine we used namecheap to register the domain names for our company. There would be an email address and password connected with our namecheap account that would be needed occasionally to register more domains, update DNS settings, etc. I'm talking about the authentication credentials to log into (for example) namecheap or other related services. However, this isn't necessarily just limited to emails/usernames/passwords, but could also include private keys or other system-critical information.

I would like to securely store all such information in a way that meets a few requirements:

  1. It is easily accessible to me, as I need one piece of information or another on a regular (weekly) basis
  2. If for some reason I were to no longer be available (aka the bus factor) this information can be passed along to someone else to minimize disruptions for the business
  3. This doesn't have to be "easily" accessible to another person - only accessible. Currently no one else needs this information on a regular basis (if ever). I just want to make sure there is a secure and easy way to transfer this information if necessary - this is not intended to be a regular occurrence.
  4. The information must obviously be very secure: "Information can be passed along" needs to be done in such away as to minimize the chances of it being accidentally or maliciously passed along to the wrong person, since this is business-critical information.

Background:

As the "Founding Engineer" at my company, I registered for just about all such services myself. There are about a half dozen very critical ones, and a dozen or so more that are not critical but still important. All services have unique, random, and long passwords. Passwords are therefore the bulk of what I want to store/share, but as mentioned there are also some private keys and other information that will likely make a password manager an incomplete solution. Currently I am the only one who has access to this information, and most of it is stored on my work computer in one form or another (home directory is encrypted and my backup hard-drive is also encrypted). Again, the issue is the fact that I am literally the only one with access. In the event of something unexpected, I would like the company owner to be able to hire someone competent and pick up where I left off without difficulty.

Currently I'm leaning towards putting the information in some sort of secure cloud hosted environment that uses encryption on their end (google drive, dropbox?). I wouldn't encrypt it myself before uploading because I expect that to hamper my own ability to access it on a regular basis. I would choose a cloud based solution that supports 2FA via a hardware key, which I would share (along with the cloud account credentials) with the owner.

That's just one thought anyway. Obviously there isn't one "right" solution here, but I'm looking for suggestions that meet my requirements above so I can find a balance that works well for us.

  • 2
    What's wrong with a password vault solution and keep the password for the password vault in a physical safe? Keep it simple, don't over complicate things. – Jeroen - IT Nerdbox Apr 10 '18 at 18:36
  • I suppose it depends on the password vault, but I have more than just passwords to store. Also some private keys and some notes/configuration information. Passwords are definitely the bulk of it, but they aren't all of it. I presume that password vaults tend to store just passwords. – Conor Mancone Apr 10 '18 at 19:36
  • 3
    Password vaults typically have notes where you can store keys, notes, and configuration info. – Neil Smithline Apr 11 '18 at 2:39
  • 2
    @ConorMancone In security we have a saying.... "Assumption is the mother of all screwups" - in other words Neil Smithline is correct that these managers often offer more than just passwords to be stored. Have a look at something like KeePass or similar products and see if it fits your needs. – Jeroen - IT Nerdbox Apr 11 '18 at 5:54
  • I use 1password myself (as a normal user but still) and it has support for encrypted notes etc as well. For example, I store my 1password license key in my vault. – Nzall Apr 12 '18 at 12:56
1

What you're describing is the intended use case for a password vault. It provides fine-grained access to passwords, and in my experience they also work with private keys and other information (I've used CyberArk in the past). With CyberArk you can manage access by using LDAP groups, which is nice for ensuring that specific groups of people have access to different account types.

But, you should know what you're getting into. For example, CyberArk is intended to be implemented as at least two servers and virtualization isn't recommended for the vault server. It's quite a bit of infrastructure to manage for a small number of secrets. In other words: perhaps a password vault is a good solution for a large enterprise, but maybe not for a smaller organization.

Another potential solution for a small business could be something like Keybase, using their 'teams' functionality. https://keybase.io/blog/introducing-keybase-teams

Also, AWS just created a new service for managing secrets. I don't have experience with this yet but perhaps it's a good fit: https://aws.amazon.com/secrets-manager/

  • They need a password vault, but god don't select CyberArk "because everyone has it". If the licensing model doesn't make you want to vomit, than they installation and documentation clarity will. – Shane Andrie Apr 10 '18 at 21:46
  • Agreed. CyberArk can meet the functional requirements, but it's bad software from an ancient yesteryear. I do not recommend. It required gigantic effort for us to stand up, configure, and maintain. – theoneandonly2 Apr 10 '18 at 22:13
  • There are other products out there that have similar functionalities and there's even a free version. It's called 'vault' and could be a nice alternative for CyberArk: vaultproject.io/intro – Jeroen - IT Nerdbox Apr 11 '18 at 5:52
0

You might want to take a look at the mooltipass which is a great single user hardware device.

If you want to manage accounts/passwords for several users take a look at passbolt, which is an open source password management solution, which can run trustworthy at your site on premise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.