I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of security. He has pointed me to your site along with many others, about the implications of sharing passwords. I understand the implications of sharing passwords among employees and vendors. What is the best practice for securing passwords within a company? What if he gets in a car wreck tomorrow? How do we manage changing passwords? How do we make all parties feel comfortable? Most of all, me, the owner.
The way to solve this through a secret store. Your IT person is correct in that you should not share passwords as is.
But you do have a claim to have emergency restore access form when someone gets under a bus or other catastrophic event (loss of memory for example).
Some of the ways to solve this are
- use a Password manager service, with a secondary recovery option.
- use a safe with a printed out recovery key, this would only give you (destructive) access back into the system and is only for emergency use. (Hence why it is in a safe)
- have a distributed secret set, for example 4 hardware (smart card) tokens where you need at least 3 together in order to decrypt the master key stored on the system.
- use something like hashicorps vault to store all the secrets, and use a shared token secret to restore access.
- use a 3rd party to mange your access.
Just make sure you not only implement a recovery process (technically), but also implement a recovery policy, e.a. Write down when and why, who may trigger the emergency use. How it’s communicated (I prefer noisy recoveries, that will automatically notify all know administrators that a recovery is attempted and done.)
What you must NEVER do is
- ask for the access tokens for a individuals account.
- write down a password in clear readable form, always make it so it takes effort to recover it.
- never test the procedure. (Make it so that you test the recovery procedure periodically, I usually recommend every 2 years or so.)
- access an account without notifying the “owner”/“user” of that account. (This is called transparency, and is a corner stone of a safe and secure organization.
I hope this helps you get an idea.
There should be multiple people with these accesses at all times.
This does not mean sharing accounts and passwords, it means multiple accounts and passwords with full access. Someone has to be able to lock this person out in the event of termination, kid napping, or whatever.
This is a business. It's perfectly normal to have a disaster recovery file locked up somewhere with all of the necessary procedures, accounts, and passwords. Typically this would be a corporate safe or a bank deposit box if the business is small.
For most businesses, high tech split key, multilevel encryption is unwarranted. A notebook and a thumb drive in a safe is probably just fine, but you would need to determine that.
Your employee is making themselves a severe liability, but we'll get back to that. Let's first address your question of access sharing.
Owner access is definitely required
You seem to know this already but it is worth emphasizing. An owner doesn't need to login regularly, but an owner needs to have the ability to step in if the current employee managing things leaves, is fired, or is just out on vacation. Does your employee plan to be available 24/7/365? If not, then there clearly needs to be a provision for someone else having access when needed.
It's time for an identity provider
It sounds like your employee is manually managing local admin passwords for your work station and servers. This works fine when there are just a handful, but doesn't scale. You need an identity provider to manage this access. This could mean things like LDAP or AD, or for more web-centric companies might mean things like Auth0 or Okta. These solutions are all designed to have multiple admins so at that point problem solved - you and the head of your IT department both have your own admin account in your identity provider, so you both have access as needed without sharing passwords.
Break glass access must be provided regardless
Your employee is really thinking about this the wrong way. These are, without question and without exception, company accounts, and as such the company must have access. Your employee has access because the company has granted that access - not the other way around. Your employee needs to be clear about that. An identity provider will make this process much easier, but in the meantime if your IT team configures a workstation or server and creates a local admin password on that machine, then that password needs to be stored somewhere so that the designated company representative can access the machine when needed.
@LvB has some good suggestions for sharing access securely. Personally I would suggest using an online password manager with the master password stored in a company safe (or other secure location). Your IT person can stay logged in to the password manager on their work computer, and anytime they "create" a new password they immediately store it in the password manager. If access is ever needed the owner can get the master password out of the safe, login to the password manager, and gain access as needed. Even better if the password manager supports a Yubi key or the like which is stored in a separate location.
This employee is quickly becoming a critical liability
For you though I really want to emphasize that this employee is not making sense and is quickly becoming your biggest liability. Intentionally or not, they are putting themselves in a position where they cannot be fired, but the opposite is not true - no aspect of this makes it so that they cannot quit. How bad would it be for your company if they left? How bad do you think it will be if this continues for a year and then they leave?
I'm guessing it would already be painful, but will only get more painful with time, which is why this needs to be addressed now. Your employee needs to understand that these are company accounts and the company needs access in the case that the employee leaves. In a small business, "the company" means the owner of course, and as the owner if you do something stupid with your access then that is on you. Your employee refusing to give others access is not a solution to protect the company. Some basic training and understanding on your part will help so that you understand that this isn't meant for daily access, but it sounds like you already understand that.
If your employee still refuses to give access then it is time for them to be let go before it gets worse. By misunderstanding security this employee is creating a severe company-wide denial of service risk, which will put you out of business if it continues for too long.
For a smaller organization with only one IT person, (or with 0 IT people and an external IT consultant), refusing to handing over access credentials to the owner is generally not OK.
For organizations in industries requiring compliance (e.g., PCI compliance), a documented security policy is typically required. Include "provide full-access credentials to the owner" in this policy. Require any IT staff to sign off on it (with an actual signature) every year. Yearly reviewing/signing off on security policies is often required for compliance.
In large organizations (i.e., organizations with multiple IT employees), it is typically not OK for the IT people to provide passwords to their boss (nor to the owner). What happens instead is that the organization's security setup has multiple trusted IT staff who have varying levels of access. Any security-sensitive requests by the owner must go through this staff. In some sense, the owner is not trusted enough for such access. This is more a matter of technical distrust, rather than fear that fear of intentional sabotage.
Further, giving the owner direct access (rather than having their needs be met less directly) may be a violation of security compliance, as many compliance policies require that people who do not need access don't have access. The owner does not necessarily need access.
Of course, all of the above can be countered by having a documented, internal policy that the owner gets passwords/access to everything. However, such a policy is typically not recommended for larger companies; a competent IT staff may resist it.
Final note: It is bad security practice (and forbidden by PCI compliance) to have shared credentials. If the owner is given access, it should be done through a separate set of admin credentials, not via password-sharing.
It is never reasonable to ask your employee to disclose their account password. It is, however, reasonable to demand either that they change their password and hand over the account to you, or that they simply create a new account for you... or as a last resort, that they log in to the account for you.
The reason for this is that the password they are using on their account could very well be the same one they use for any number of services outside the company or for personal use. It's not surprising that they are pushing back on your demands for them to hand their password over; it's sensitive personal information and their password is theirs, regardless of whether you own the system.
If the actual issue is that they won't give you access to these systems at all though, that's a case where you can and should take them to court.