What standards are there for mangaging high value passwords?

Question

I am leading a small team at a start-up and I am facing a dilemma with high value passwords.

I am the only one on the team who knows all the key passwords for production servers, databases ... etc. If I get run over by a bus the rest of the team has no way of getting back into all these essential services.

What standards exist for processes around deciding who should have access to high value passwords and how is it communicated and stored? How have you dealt with this issue on previous teams / start-ups.

The application we are working on stores financial data, thus my interest in "standards".

Update:

To answer some of the questions in the comments:

• All Servers are RedHat Enterprise Linux
• App Server is tomcat
• Database is postgres
• Datacenter is SSA16 certified
• Dedicated Servers
• Every server has three separate physical networks it is part of, production traffic in one one nic, backups on another nic, and server management on another nic.
• High value passwords to secure Linux Server Passwords, SSL certificates, passwords for JKS files, passwords for development infrastructure and deployment infrastructure such as SendGrid,stripe,Jira,source control, ... etc.

Update 2:

So far the answers are all suggesting ways of solving the problem, but are there are any standards backed by some standards body about how to do this? I will keep this question open in hopes of some one being able to name specific standards.

Answer 1

For maintaining Application passwords , I had come across an open source tool called CorporateVault . It is a multi-user password management web application designed for organizations to store passwords. Written in Grails, Groovy and Java.

It is a good tool to use for managing passwords

Answer 2

So in the vein of standards, the fact that you have all of the credentials to all of the systems is already a giant red flag (unless you are the only person on the team). Now I understand it is a startup, but just mentioning it as your company grows. Moving on, what should happen is there should be an administrator (different person for each system) that has the credentials for that specific system, along with a separate person who has the ability to restore/reset that password in the case of breach/ lost password. It is important to keep these people separate and to enforce password as well as position rotation. So this quarter I am a software engineer, next quarter I am a DBA, etc. Forcing an admin password change each time.

Basically what you want is a clear separation of duties for each person responsible for administering a system, this will also help to mitigate the concept of insider threat (not completely remove, but it allows for better 'tracking'). This type of thing is generally laid out in a policy that has to have teeth (enforceable and have repercussions including termination).

If the question is how to manage these passwords in a secure way, in terms of storage on hardware let me know and I will make efforts to answer that.

EDIT

Another potential solution is to generate a random administrator password daily and distribute it to the proper people via an encrypted email, this will also reduce the exposure of the systems to insiders and outsiders.

Answer 3

In companies I have worked at, they have given me access to a website where I can login using my Active Directory password and request a password for any server. If my login is cleared for that server I see the password in plain text, else I would receive an unauthorised error message.

You could also use some third party password management software, a quick Google search will return results such as KeePass.

Answer 4

One approach is to write down all the passwords and store them in a physical safe. If you have an admin or accounts person, they area a good choice to manage these. If you are run over by a bus, they can make the passwords available to your replacement. Another possibility, considering your position as a startup founder, is to give these to your lawyer or accountant, or maybe your wife.

You ask specifically about standards. ISO 27002 would be the first place I'd look for information on this. I just had a quick look and couldn't find anything specific. One consideration though is individual accountability. Rather than give someone your password, you should create separate accounts with the same privileges (and a different password) - and keep those second accounts safe.

A risk with this approach is that you are placing complete trust in someone. Your wife or accountant could take complete control of your servers. There is a technical solution for this called secret sharing. You could, for example, give three people parts of the secret, and arrange it so that any two of them can combine their secrets to recover the passwords. However, this is probably more a technical curiosity rather than a system you actually want to use.