0

Scenario: a medium company (750 users). Some of them use online services to store their credentials (office email and other web applications), like lastpass and 1password.

The IT wants to audit the credentials: with the collaboration of the users, they login to the online vault (the colleague type the master password) and check which corporate credentials are saved.

IT (and users) don't like doing this by hand: it takes time and you see all stored credentials (both corporate and personal).

For simplicity, let say we want to check the credentials of the intranet application BUBU. Pitfalls of the manual auditing:

  1. User collaboration

The colleague must be present and honest. She/he can cheat and say "I don't user online vaults" ...

  1. Login to the vault

Sometimes the vault login coincides with the BUBU credentials. Sometimes the vault credentials are personal, and the BUBU ones are stored as application credentials inside the vault.

  1. Excessive disclosure of credentials

If the user hasn't corporate credentials stored in an internet vault, trying to login using userid/email and password is a disclosure of the credentials!

Is it possible to automate the audit?

My solution: ask to the online services to implement a specific API audit user credentials

input parameters: userid, sha256(userid + password)

output: YES if there is any credentials (vault login or application specific) matching the input ones

This API permits to audit the credentials with these advantages:

  • company: the credentials not stored in a vault aren't disclosed;
  • company: it can automate this test for every set of credentials of every user;
  • vault service: no disclosure of the kind of credentials (master or application ones).

Is this a good solution? are there better ones?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.