At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method:
- The length of each password must be 16 characters, where they input 8 characters while the IT Infra team give the remaining ones.
- Each team will print the partial password on paper and will seal it by envelope, so there are two envelopes to combine the whole password for each account
- The authorized representatives will sign and seal envelopes. Unless there is approval from IT Security Officer, these envelopes cannot be unsealed or disclosed to anyone.
My question is that does this way seem so manual and time-consuming? I suggested using password manager, but no one shared the same idea.