4 ms·
> We tend to have zillions of passwords in IT jobs right? Yes, but they should be unique to your account. I.e. via SSO. > What are the recommended ways to sto
by zie 2y ago
> We tend to have zillions of passwords in IT jobs right?
Yes, but they should be unique to your account. I.e. via SSO.
> What are the recommended ways to store and give access to passwords?
Whenever possible, don't. Otherwise, it depends on the scale and security you need. A password manager is one possible solution. Another solution is something like Hashicorp's Vault or OpenBao.
> How can a new hire be given access to all required passwords day 1?
They should access it through their SSO account, and not need a billion passwords across systems.
> And when such new hire gets promoted, how can we give access to the additional passwords they will need?
Again, whenever possible, tie access to their SSO account.
> And if someone leaves the company, how can we change only the sensible passwords they had access to and preferably notify everyone with access to it that it was changed?
Well if you did all of the above this wouldn't be an issue, you just close the 1 account.
> Any best practices? Any 80/20 suggestions? Low hanging fruits? Any warnings about what not to do?
Another thing you can do is give people 2 accounts, a normal account and an Admin level account, this is useful for things where the employee needs a regular day to day account as well. i.e. for the employee self portal for instance.
- healsdata 2y ago> Yes, but they should be unique to your account. I.e. via SSO. This is a great best practice, but user-based value metrics for many SaaS platforms make this untenable for some IT departments. If folks have to log in seldomly, it's very hard to make the business case to pay per user. Similarly, there's many SaaS platforms that charge A LOT extra for SSO because you have to upgrade to their Enterprise-pricing model. If managing a separate user directory isn't worth it because the software isn't personalized, understaffed IT departments aren't going to do that either. So while there is a best practice, dismissing solutions that are "good enough" (while sharing tradeoffs) isn't as helpful.
- wahnfrieden 2y agoShared PWs are sometimes inevitable but then you must rotate them every time someone with access leaves the company. OneLogin also has a way to minimize handling of the shared passwords for auto-logins that depend on shared creds
- from-nibly 2y agoIs sharing accounts not against the TOS of any user priced saas company?
- J0BC6xEIDNi4 2y agowe inquired about this to grafana.net, and their reply didn't forbid sharing accounts
- Maxion 2y agoProbably but IRL: A) Who reads those? B) Who cares if e.g. Miro finds out you're sharing accounts and get banned?
- baxtr 2y agoWe change our PW for some platforms every month, so that people leaving won’t have access anymore
- zie 2y agoWell except for the period of time between them quitting and the new month rolls around. You really should change passwords the second they leave. Yes it's a PITA, but you should do it anyway.
- steve1977 2y ago> So while there is a best practice, dismissing solutions that are "good enough" (while sharing tradeoffs) isn't as helpful. In many environments, sharing passwords is never "good enough".
- ozim 2y agoNot only user-based value metrics - but also SaaS apps don't implement collaboration in approachable ways for groups. I can setup shared inbox and shared account that all users will have access to. If we would properly manage configuration for each SaaS app we would have to have full time employee just to do that. Yes there is SSO and you can setup roles and rights and align that - but let's say you have Joe in CRM SaaS that has customer X - Joe leaves and only he gets notifications, now someone still has to reconfigure CRM so Jane gets the notifications, removing access from Joe is easy. That is why companies get shared inboxes because then you have pool of employees that will check shared inbox and also shared account. Yes in ideal world Joe does handover of his customers and configurations before he leaves, but we know world is not ideal.
- Maxion 2y agoThere's A LOT of good advice for SaaS companies here. The problem e.g. you desribe is clearly something thats solvable on the SaaS side.
- gazoakley 2y agoSSO all the way (if you can). Chances are you've got Google Workspace or Microsoft 365 - both allow you to configure SAML based SSO into many SaaS apps either through their respective app galleries or some kind of custom configuration. Otherwise you could look at Okta, but be prepared to fork out serious cash. We use Entra ID (part of Microsoft 365) for SSO in our business, and it generally works well. There'll be times that employees can't use SSO though. For that I'll add my voice to 1Password - it's well designed such that a breach of the 1PW service itself won't reveal credentials (you'd need peoples vault passwords and secret keys for that). Avoid Lastpass - the UI is awful, and they've been breached in the past.
- ddtaylor 2y ago> Avoid Lastpass - the UI is awful, and they've been breached in the past They have had multiple serious breaches and to add insult to injury they have engaged in some gaslighting-esque style marketing to inquiries.