3 ms·

What are the good password practices for handling passwords that several people need to be able to use? I have yet to be in an organization that hasn’t default

What are the good password practices for handling passwords that several people need to be able to use? I have yet to be in an organization that hasn’t defaulted to something quite unwise simply because trying to maintain the institutional knowledge of that password is otherwise difficult.

klinskyc 6y ago
The good password practice is to not do this.
dangoor 6y ago
You can use a team-oriented password manager with access controls, 2fa, etc.
JimDabell 6y ago
> What are the good password practices for handling passwords that several people need to be able to use? Mostly – don’t. Every user that has access to a system should have their own credentials. There’s no reason for an update server to be set up this way.
- viraptor 6y ago
  This. Assign required roles to existing company accounts. Use SSO where possible. Don't have shared "god accounts" for anything.
  - deleted 6y ago
    [deleted]
lemonspat 6y ago
You can SSO the password to an identity store (LDAP / AD), add MFA Or, you sign a key/certificate for each user, add MFA Or, you create a complex password for each user, and add MFA Or you create a complex password, shared in a keystore that handles checkout and rotation Worst case, if you're lazy, you create a complex password for a handful of your teammates and reset it when a team member leaves Or if you're solarwinds, you apparently choose gross negligence
- ineedasername 6y ago
  In their defense, gross negligence takes less time and money, and they probably won't suffer much from this incident, so it all still paid off on the bottom line, and now a whole lot more people know who they are. Free marketing! Bonuses all around!
jasonjayr 6y ago
We used to have a shared password. We've moved to identity + role based access control, but some older core pieces still used the shared password. We simply have a portal that authenticated users can log into it, and see the current password which is rotated monthly, with a random selection from a series of dictionary words. (which can occasionally produce giggleworthy combinations) But as the sibling comment says; the right way is to get rid of it entirely.
- millzlane 6y ago
  ours are rotated daily. If you don't have a key on you, you can "break glass" in a portal and get a temp password for 4 hours. We're in the process of phasing out service accounts.
Riverheart 6y ago
Use a shared vault like LastPass or Password Hub
xnyan 6y ago
If you can build a house with a door, you can put a decent lock on the door. If you can’t put a lock on the door or don’t understand why or how, you can’t really build a house.
NoPicklez 6y ago
Realistically you shouldn't, I work in auditing and there are very few use cases where sharing passwords is okay. But here are a couple of approaches. - Using a password manager where there is audit logging that is reviewed and the access to the passwords is segregated to those who need it - Using a privileged access monitoring tool such as CyberArk - Simply creating separate named privileged accounts for each person to use is the best alternative
- indigodaddy 6y ago
  Part of CyberArk's functionality is also rotating/updating local accounts on systems as well (including root).
cj 6y ago
> What are the good password practices for handling passwords that several people need to be able to use? The answer is typically “never share accounts” and therefore never share passwords. I wouldn’t the surprised if “do not share credentials” is explicitly stated in solarwinds internal security policies. Beyond the challenge of sharing strong passwords, there’s also the (important from compliance perspective) issue of losing the ability to audit who took what action if multiple people use the same credentials.
pmorici 6y ago
I agree with the others that the right answer is don't. But if you are going to anyways a way to do it less idiotically is to use the 'static password' feature of a YubiKey. [0] That at least eliminates the desire to pick too simple of a password or to not change it on a regular basis for fear of having to memorize a new password. This doesn't protect against a malicious insider giving the password away but it makes it easy to use a strong (randomly generated) password. [0] https://www.yubico.com/resources/glossary/static-password/ https://www.yubico.com/resources/glossary/static-password/

klinskyc 6y ago

The good password practice is to not do this.

dangoor 6y ago

You can use a team-oriented password manager with access controls, 2fa, etc.

JimDabell 6y ago

> What are the good password practices for handling passwords that several people need to be able to use? Mostly – don’t. Every user that has access to a system should have their own credentials. There’s no reason for an update server to be set up this way.

viraptor 6y ago
This. Assign required roles to existing company accounts. Use SSO where possible. Don't have shared "god accounts" for anything.
- deleted 6y ago
  [deleted]

lemonspat 6y ago

You can SSO the password to an identity store (LDAP / AD), add MFA Or, you sign a key/certificate for each user, add MFA Or, you create a complex password for each user, and add MFA Or you create a complex password, shared in a keystore that handles checkout and rotation Worst case, if you're lazy, you create a complex password for a handful of your teammates and reset it when a team member leaves Or if you're solarwinds, you apparently choose gross negligence

ineedasername 6y ago
In their defense, gross negligence takes less time and money, and they probably won't suffer much from this incident, so it all still paid off on the bottom line, and now a whole lot more people know who they are. Free marketing! Bonuses all around!

jasonjayr 6y ago

We used to have a shared password. We've moved to identity + role based access control, but some older core pieces still used the shared password. We simply have a portal that authenticated users can log into it, and see the current password which is rotated monthly, with a random selection from a series of dictionary words. (which can occasionally produce giggleworthy combinations) But as the sibling comment says; the right way is to get rid of it entirely.

millzlane 6y ago
ours are rotated daily. If you don't have a key on you, you can "break glass" in a portal and get a temp password for 4 hours. We're in the process of phasing out service accounts.

Riverheart 6y ago

Use a shared vault like LastPass or Password Hub

xnyan 6y ago

If you can build a house with a door, you can put a decent lock on the door. If you can’t put a lock on the door or don’t understand why or how, you can’t really build a house.

NoPicklez 6y ago

Realistically you shouldn't, I work in auditing and there are very few use cases where sharing passwords is okay. But here are a couple of approaches. - Using a password manager where there is audit logging that is reviewed and the access to the passwords is segregated to those who need it - Using a privileged access monitoring tool such as CyberArk - Simply creating separate named privileged accounts for each person to use is the best alternative

indigodaddy 6y ago
Part of CyberArk's functionality is also rotating/updating local accounts on systems as well (including root).

cj 6y ago

> What are the good password practices for handling passwords that several people need to be able to use? The answer is typically “never share accounts” and therefore never share passwords. I wouldn’t the surprised if “do not share credentials” is explicitly stated in solarwinds internal security policies. Beyond the challenge of sharing strong passwords, there’s also the (important from compliance perspective) issue of losing the ability to audit who took what action if multiple people use the same credentials.

pmorici 6y ago

I agree with the others that the right answer is don't. But if you are going to anyways a way to do it less idiotically is to use the 'static password' feature of a YubiKey. [0] That at least eliminates the desire to pick too simple of a password or to not change it on a regular basis for fear of having to memorize a new password. This doesn't protect against a malicious insider giving the password away but it makes it easy to use a strong (randomly generated) password. [0] https://www.yubico.com/resources/glossary/static-password/ https://www.yubico.com/resources/glossary/static-password/