Securely storing account credentials/information for critical company services - the bus factor

Question

Question:

I'm trying to figure out best practices for storing authentication credentials for critical company services - hosting services, domain registration services, recruiting portals, etc... To be clear, I'm not talking about API authentication credentials (those are stored and made available to our code base using best practices), but administrative access to the actual accounts themselves. As a randomly chosen example, imagine we used namecheap to register the domain names for our company. There would be an email address and password connected with our namecheap account that would be needed occasionally to register more domains, update DNS settings, etc. I'm talking about the authentication credentials to log into (for example) namecheap or other related services. However, this isn't necessarily just limited to emails/usernames/passwords, but could also include private keys or other system-critical information.

I would like to securely store all such information in a way that meets a few requirements:

1. It is easily accessible to me, as I need one piece of information or another on a regular (weekly) basis
2. If for some reason I were to no longer be available (aka the bus factor) this information can be passed along to someone else to minimize disruptions for the business
3. This doesn't have to be "easily" accessible to another person - only accessible. Currently no one else needs this information on a regular basis (if ever). I just want to make sure there is a secure and easy way to transfer this information if necessary - this is not intended to be a regular occurrence.
4. The information must obviously be very secure: "Information can be passed along" needs to be done in such away as to minimize the chances of it being accidentally or maliciously passed along to the wrong person, since this is business-critical information.

Background:

As the "Founding Engineer" at my company, I registered for just about all such services myself. There are about a half dozen very critical ones, and a dozen or so more that are not critical but still important. All services have unique, random, and long passwords. Passwords are therefore the bulk of what I want to store/share, but as mentioned there are also some private keys and other information that will likely make a password manager an incomplete solution. Currently I am the only one who has access to this information, and most of it is stored on my work computer in one form or another (home directory is encrypted and my backup hard-drive is also encrypted). Again, the issue is the fact that I am literally the only one with access. In the event of something unexpected, I would like the company owner to be able to hire someone competent and pick up where I left off without difficulty.

Currently I'm leaning towards putting the information in some sort of secure cloud hosted environment that uses encryption on their end (google drive, dropbox?). I wouldn't encrypt it myself before uploading because I expect that to hamper my own ability to access it on a regular basis. I would choose a cloud based solution that supports 2FA via a hardware key, which I would share (along with the cloud account credentials) with the owner.

That's just one thought anyway. Obviously there isn't one "right" solution here, but I'm looking for suggestions that meet my requirements above so I can find a balance that works well for us.

Answer 1

What you're describing is the intended use case for a password vault. It provides fine-grained access to passwords, and in my experience they also work with private keys and other information (I've used CyberArk in the past). With CyberArk you can manage access by using LDAP groups, which is nice for ensuring that specific groups of people have access to different account types.

But, you should know what you're getting into. For example, CyberArk is intended to be implemented as at least two servers and virtualization isn't recommended for the vault server. It's quite a bit of infrastructure to manage for a small number of secrets. In other words: perhaps a password vault is a good solution for a large enterprise, but maybe not for a smaller organization.

Another potential solution for a small business could be something like Keybase, using their 'teams' functionality. https://keybase.io/blog/introducing-keybase-teams

Also, AWS just created a new service for managing secrets. I don't have experience with this yet but perhaps it's a good fit: https://aws.amazon.com/secrets-manager/

Answer 2

You might want to take a look at the mooltipass which is a great single user hardware device.

If you want to manage accounts/passwords for several users take a look at passbolt, which is an open source password management solution, which can run trustworthy at your site on premise.