0

To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best practices for storing admin account credentials?

My two cents: An obvious answer might be encrypt the data and store it in a db. My response to that is say there's a data breach, the db is compromised, maybe the nefarious user(s) grab a copy of your db, deletes the db, and now your admin creds are all gone and you cannot access any systems because you don't know the admin credentials. Maybe storing it n the db is a good move to help ensure the data is encrypted and in one centralized location, but you're still vulnerable if an attack is successful.

There's two-factor authentication and store the data with a third-party but does it make sense to store company sensitive admin credentials with a third-party?

So, I go back to password-protected files or spreadsheets. If only a limited number of people within an organization need to know the admin creds, does it make more sense to store it in a spreadsheet or file, password protect it with AES 256-bit encryption using a very strong password (longer the better), and securely pass the file around to those who need it and update the passwords on a frequent basis? The file would be stored on the local machine of each user who are privy to the information. And maybe break out the creds into several files and each file has a different password to open it.

I'm very curious to hear what others in the community would recommend.

  • 1
    Why are you sharing passwords instead of having multiple users as administrators? Each of them can have their own logins and you can even have an audit trail this way. – Limit Aug 10 at 23:30
  • That would be a great idea, actually. The problem at hand is I'm not talking about one system. I'm talking about several different systems. Let's say 100 internal and external applications and each app has their own creds. Each of those apps have different requirements for how admins are setup. Some apps require an admin user, in addition to users with admin role. I have to take that into account. Unfortunately, it's not that simple. That is a good idea, though. I may have to re-investigate each app to see if the admin user can be eliminated. – user3621633 Aug 11 at 17:03
  • Also, while you are at it, it would be a good idea to check if those systems support single sign on. That can help as well – Limit Aug 12 at 18:28
1

I'd rather have a password manager with 2 factor auth. You're quite right, in that it's a target, and it's got to be one of your #1s in any kind of DR scenario. I think the advantages of one source of truth, secure password sharing, true random password generation, and granulated access control are worth the hassle of having another system to make highly available, etc.

There's so many disadvantages with using multiple copies of anything, so many ways it's open to abuse and human error...even within a small team.

| improve this answer | |
  • Yes, that's the problem with multiple copies, instead of one centralized location. Would you use a password manager with 2-auth on a company domain or third-party? If it's hosted internally and that system gets breached, maybe the hackers can't decrypt the data but they can delete it and then I'm in a real pickle with no way to get into any apps which require an admin user (as opposed to users with admin roles). What can take hours to get in may take days or weeks on the phone with various vendors. It's a nightmare scenario if we lose those creds. – user3621633 Aug 11 at 17:09
  • 1
    If I was standing something like this up in the cloud, I'd want access whitelisted to my IP address/es. Way round might be to do that but also include IP addresses of a trusted third party as a break-glass type thing, if your whole network got really borked. On prem, it's ultimately going to come down to your backups / backup infrastructure... – D0gfather Aug 11 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.