I'm trying to figure out best practices for storing authentication credentials for critical company services - hosting services, domain registration services, recruiting portals, etc... To be clear, I'm not talking about API authentication credentials (those are stored and made available to our code base using best practices), but administrative access to the actual accounts themselves. As a randomly chosen example, imagine we used namecheap to register the domain names for our company. There would be an email address and password connected with our namecheap account that would be needed occasionally to register more domains, update DNS settings, etc. I'm talking about the authentication credentials to log into (for example) namecheap or other related services. However, this isn't necessarily just limited to emails/usernames/passwords, but could also include private keys or other system-critical information.
I would like to securely store all such information in a way that meets a few requirements:
- It is easily accessible to me, as I need one piece of information or another on a regular (weekly) basis
- If for some reason I were to no longer be available (aka the bus factor) this information can be passed along to someone else to minimize disruptions for the business
- This doesn't have to be "easily" accessible to another person - only accessible. Currently no one else needs this information on a regular basis (if ever). I just want to make sure there is a secure and easy way to transfer this information if necessary - this is not intended to be a regular occurrence.
- The information must obviously be very secure: "Information can be passed along" needs to be done in such away as to minimize the chances of it being accidentally or maliciously passed along to the wrong person, since this is business-critical information.
As the "Founding Engineer" at my company, I registered for just about all such services myself. There are about a half dozen very critical ones, and a dozen or so more that are not critical but still important. All services have unique, random, and long passwords. Passwords are therefore the bulk of what I want to store/share, but as mentioned there are also some private keys and other information that will likely make a password manager an incomplete solution. Currently I am the only one who has access to this information, and most of it is stored on my work computer in one form or another (home directory is encrypted and my backup hard-drive is also encrypted). Again, the issue is the fact that I am literally the only one with access. In the event of something unexpected, I would like the company owner to be able to hire someone competent and pick up where I left off without difficulty.
Currently I'm leaning towards putting the information in some sort of secure cloud hosted environment that uses encryption on their end (google drive, dropbox?). I wouldn't encrypt it myself before uploading because I expect that to hamper my own ability to access it on a regular basis. I would choose a cloud based solution that supports 2FA via a hardware key, which I would share (along with the cloud account credentials) with the owner.
That's just one thought anyway. Obviously there isn't one "right" solution here, but I'm looking for suggestions that meet my requirements above so I can find a balance that works well for us.