0

I've looked around and not seen any solutions to this problem

I work for a company as an automation engineer keeping a network behind a DMZ. I have an AD, switches, etc. We have local passwords for our switches, special accounts for vendor supplied software, the AD admin (which is required to be logged in for some vendor software), etc. In the past month, we lost the other 3 people in the group, leaving me as the only one who knows some of these username/password combinations, and I now need to change them. It occurs to me that I will be the only one who knows some of this and is something was to happen to me, there would be no way to get someone else in without a full reset.

What I am looking for is a way to store the credentials so that I can set up a couple of people with accounts that could view the combinations in plain text using their own credentials. Ideally something stored offline which I could host on the off-line system. Would have the people I am training have access as well as a couple of backups (probably the plant manager and head of security) in case of emergency. Has anyone done something like this?

Improve this question
1
  • 2
    Enterprise password managers are designed exactly for this kind of problem of having many users, many passwords and managing which users can have access to which passwords, ideally integrated with already established authentication methods within the organization. There are a lot to choose from - but specific product recommendations are off-topic here.
    – Steffen Ullrich
    Sep 18 at 6:25

1 Answer 1

Reset to default
1

There are plenty of options. It all depends on your requirements, constraints and the key management policy that you follow (specifically, how often do you rotate the keys at question).

The most basic one is to print the credential list and store it somewhere safe, where only authorized people have access to.

A similar one is to store the credentials in two (or more?) usb sticks, that are encrypted. The one should be kept in your company's premises and the other somewhere else. Each stick should be encrypted with a different, strong, passphrase.

However, the solutions above are not ideal when it comes to key rotation1 and/or personnel change2, because the overhead of updating the usb sticks will probably make the process unconfortable to follow.

This is why people use password managers (as Steffen mentions in his comment). Password managers offer you better user experience (easier credential and user management), however you need to make sure that the system which hosts your password manager is secure and have a proper DRP setup.

1 rotation of the credentials themselves and the encryption keys of the usbs

2 this is not a problem for newcomers (you just let them know of the decryption key(s) of the usb stick(s)), but for people that leave your company or move on to positions that do not require knowledge/access to the credentials; you'll have to rotate the encryption keys of the usb(s), unless you opt for a more complex key management scheme (e.g. you have multiple keys decrypting the usb(s), each key corresponding to each employee, when the employee leaves/moves on you disable/delete his key)

Improve this answer
1
  • And don't forget PAM, which is the typical solution for this problem in the enterprise space.
    – schroeder ♦
    Sep 18 at 10:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .