Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
How do most teams handle the storage of passwords, in particular the required changes when team members leave ?
Right now, we use a centrally stored encrypted file but the thought of changing 100's of passwords when key employees leave is a bit overwhelming.
We use a truecrypt vault with our shared/hardcoded passwords. Some of the team keep an encrypted copy of the file on their phone.
We use AD to push out local Administrator passwords to our Windows servers.
We use puppet to change the local root passwords and remove ex employee ssh keys from our Linux servers.
We use Kiwi Cat tools to manage our Cisco hardware, and use it to reset passwords.
That still leaves less than a dozen "one-off" devices (UPS's, remote PDU's, printers, etc) that we manually update.
We change passwords every 6 months, or immediately when we lose a team member.
One method I've seen used at larger companies is products like Cyber-Ark that essentially take control of the passwords for the boxes and then have a set-up where you can request a password for a specific host for a time period. The application then gives you the password and changes it after the time period is up. An additional advantage to this approach is that you have a log of who had access to the server and when.
That way when a team member leaves they won't actually know any of the passwords. Obviously you need to combine this with monitoring tools to stop people adding unauthorised accounts or back-doors but if you've got enough accounts to manage it can be a good approach.
At my department, identity and access control is centralized in IPA, which allows to:
When a team member leaves, his/her account is disabled in a first step, and removed afterwards, through the proper management workflows.
