How to detect passwords in wiki pages?

Question

Is it possible to use any automated scanning tool in order to detect stored passwords in our internal wiki pages?

Answer 1

You're trying a technical solution for a people problem. This won't work.

Storing passwords on internal wiki pages is not a good idea. You never know when they may accidentally be disclosed (e.g. screen sharing during a meeting with externals). However, automated tools are not that good at detecting what may be a password and what may be some other technical data (host names, etc.).

Any solution you come up with will either have a sizable chunk of false positives (meaning, it will recognize things as "potential passwords" that are in fact not passwords) or it will have just as many false negatives (meaning, it will classify something as "not a password" when it in fact is a password).

A much better solution would be to explain to people why storing passwords in the internal wiki is a bad idea and, most importantly, how they can do better. Should you still find passwords in a wiki after that, have an informal talk with that person. Don't be like "You did a bad thing and I am scolding you", but more like "I know you did this because you're trying to do your job, but if you do it that way, it not only is safer, but also makes your job easier".

As for how to actually store and distribute passwords, you can consider password managers. There are several products out there that offer password management for teams, so you may need to do some digging and some case studies on what works best for you. For example, you could buy a smaller license for just one or two of your teams of product A, and the same for product B and C - then two months later, you compare which teams made good experiences, and which teams made bad experiences.

Not only does this give your teams the feeling that they're involved in the decision making, but it also sneakily trains a part of your userbase on how to use a tool, which they can then help other users with.