Company Password Management

Question

The topic of personal password management has been covered in great detail time after time. This question is aimed at the business or organization that needs to keep track of many unique passwords for many clients. What are some strategies/tools or ideas you all have for accomplishing this task?

I was at an Interactive Agency, where we needed to keep track of client DB, ftp, mail... and for different environments for the app so any one client would have up to 3-10 passwords usually. This can get crazy when there are more than 250 clients

Answer 1

I have been on a quest to find, and convince our organization to use, an industrial strength, multi-user, password manager for a long time now. I see, I am not alone.

If you do not mind, I would like to post and maintain my quest notes here until my goal is reached.

Summary

Storing passwords and other sensitive information in solutions like password protected files, simple databases, intranet pages does not provide enough security, control or auditing, in a multi-user settings environment. A more adequate solution would meet the following requirements.

Requirements

• Multi-User.
• Multi-Computer.
• Auditing.
• Secure Notes.
• Clear text exports.
• A known and trusted encryption method.
• Authentication information should only be stored as a hash.
• Data should be encrypted on the wire.
• Data should be stored on local network.
• Should work for the entire organization, even if it requires multiple instances.
• Reasonably priced.
• Active Directory integration.

• Password Sharing.

  Would-Be-Nice Features...

• Multi-Factor Authentication.
• Zero installation on client pc.
• An API to do common tasks like backups.
• Open Source.
• Secure File Storage.

• Web and/or GUI Single Signon capability.

  BONUS

• Able to sell itself to a resistant organization.

Promising Options

Enterprise

• Console Password Manager (cpm)
• Corporate Vault
• TOTAL Privileged Access Management Suite by e-DMZ Security
• Enterprise Password Safe
• Highly Sensitive Information Management Suite by Cyber-Ark
• LastPass - Enterprise
• Network Password Manager
• OneLogin
• Passpack
• Password Keeper Vault by BeyondTrust
• Password Manager Pro
• Password Manager XP
• Passwordstate by Click Studio
• Password Vault Manager
• Quest One by Identity Solution
• Secret Server
• WebPasswordSafe

Personal

• KeePass Password Safe
• LastPass
• Password Agent
• PasswordSafe (now works with YubiKey)
• Xecrets

More

• List of Password Manager Software

Answer 2

At my last company we used Intuit's Quickbase. Quickbase seems to be like a sort of online MS Access database where you can easily build tables and their relationships. It made it very easy to create a simple password database that was searchable, access controlled, and secured via SSL.

Intuit Quickbase - http://quickbase.intuit.com/

Answer 3

I believe that this can be done at least in part with a properly configured LDAP/active directory configuration.

Answer 4

Have a look at the following:

• Thycotic's Secret Server ( http://www.thycotic.com/ )
• Manage Engine's Password Manager Pro ( http://www.manageengine.com/products/passwordmanagerpro/ )
• Cyber-Ark's PIM ( http://www.cyber-ark.com/digital-vault-products/privileged-identity-management/index.asp )
• BeyondTrust's offerings ( http://www.beyondtrust.com/ )
• e-DMZ's offerings ( http://www.e-dmzsecurity.com/ )

Answer 5

Where I work we have been using KeePass 2.x to store about 1000 passwords for the last three years. This works ok with one file accessed by about 4 people concurrently.

You can organise the passwords into folders (one per client per example), and the search functionality works very well.

There may be some limitations to their multi-user approach, and we may just have been lucky not to hit them (yet), but it seems ok for our scale, and it is an actively developed Open Source project with a good reputation for being secure against decoding.

What is nice about KeePass is it is designed with passwords in mind, so includes password generation features. It is highly configurable, and you can add your own custom columns to the database.

Answer 6

At our company, we use a basic database app, with a table set up for each type of password. The problem is it doesn't scale with hundred and hundreds accounts. We have about 400 customers each has a dev ftp account, dev mysql, prod mysql, etc. Doesn't scale!

We are looking into creating our own solution that will map the data in a more useful way. To where passwords are grouped by customers and information is stored there. So we can see which domains that have passwords are associated with each client. And set it up to where we can add services that might have extra fields. i.e. Database passwords would need a DB Name and Server Location and (at least for MySQL) the login host.

Doing something like this would allow us to find all passwords associated to a client, and then, a domain, or even a server if designed out correctly.

I guess really, we are looking for a basic account management app that handles passwords at it's core, but also stores some other basic information about the environment.

Not a lot out of apps out there that handle password management outside of personal environments

Answer 7

At a previous company I worked for, every co-worker had a GPG-key and the list with passwords would be encrypted with the key. Every time a new password was added, the list was decrypted, password added and re-encrypted with all keys. We made some scripts that made adding, deleting, changing and viewing easier.

Answer 8

We normally setup an internal MySQL database with everything stored by client. Tables are created on a per client basis.

Answer 9

I've been looking into putting SFLvault in place at work.

Description from the project's wiki:

SFLvault is a Networked credentials store and authentication manager.

It has a client/vault (server) architecture allowing to cryptographically store and organise loads of passwords for different machines and services.

Two of it's features I'm looking into are a permission management system (different accounts have different access to passwords) and automatic connections to services (ssh, mysql, sudo...).