How to manage passwords in a huge Organisation?

Question

I always wonder how do they manage many different passwords in an organisation.

I work in a company of 20 and find it very difficult to protect applications using passwords. Employee A comes in for a job. I give him the password for the sales email ID. Suddenly he leaves the job after a week. Then I change the password of the email again. Employee B joins in. He gets the newly assigned password. And so on.

This is just for email. The most crucial part comes where many different third party services are involved and each service having a password. Right now, I am the only one in the company to have all those passwords and I don't even dare to share them with others. That includes the web server logins, web host logins, ISP logins, VOIP logins and many more. What will happen in case if I am dead tomorrow? Definitely the services are going to be interrupted and it may take a while for all the paperworks to be done by the management to get back the accesses. In worst scenarios like the in-house web servers, it's even very difficult to get back the acccess without my presence.

What would be the right way to manage accounts? How they do it in big organisations? This has always been a question with no right answer, at least for me.

Answer 1

Centralizing accounts. The new guy should use his own unique personal account and you would assign his account permissions to use the sales email thingie - not distribute more passwords to the poor guy.

This is not an easy goal to obtain especially with a lot of third party services, but it's the one I'll always strive for. You can mask single-password external servers by using various proxies on the inside as well, letting authenticated individuals through without them knowing what that service password is using.

VOIP should be easy enough to integrate with a central authentication mechanism. Always strive for a single place where accounts and passwords are managed - use LDAP integration and other synching methods at all times and at any cost (imo). Access should be decided upon assigned roles, not individual passwords or accounts.

Of course, have the routines you need to perform written down somewhere. If all else fails have some master passwords written up inside a safe which only some managers have access to if something would happen to you - though most passwords can always be recovered/reset by a call to the third party by a manager, or by physical access to a local server.

Answer 2

Password management programs such as Secret Server or Password Manager Pro would come in handy for large organisations. KeePass is nice, but impractical when you have much more than a few members that need access to certain passwords, but maybe not have access to others. You could divide your passwords amongst multiple files -- but then you have to manage the passwords for the files themselves and there's no auditing and it's just a big mess. Centralized password servers are the way to go once a certain level of complexity is reached since you can restrict what users can see which passwords based on roles and etc. The web department used Secret Server at one organisation I worked at with seeming success.