by Bryon D Beilman
Is your IT password policy putting your business at risk? If someone asked you this question, the first thing that you might think about is using good passwords, encryption, enforcing and perhaps even the use of one time passwords. Instead, I am referring to the process of recording and storing the passwords to your routers, hosts and anything that requires a username and password. This includes your vendor and support accounts, admin accounts and any device that is important to you.
If you are relying on an IT admin to keep track of these passwords, or you are the IT person keeping track of them, then you may want to ask yourself a few of these questions.
I have seen many solutions out there from using an encrypted word file, to a password encrypted database where each password was unique and had to be unlocked based on who you and even the use of a sticky note inside a desk. In my April 9th Blog, I talked about a program called Password Safe, which you can get at http://passwordsafe.sourceforge.net/ , that has a single password that unlocks the files containing usernames and passwords. This works well for smaller companies and could even be used in such a way that it would scale.
Off-line access could be defined as being on someone (or multiple laptops), being printed and stored in a secure location.I have seen people put individually wrapped passwords into a secure envelope into and HR folder or secure location that can be opened during an emergency. Off-line storage of passwords has to be closely coupled with the change management process and make sure that the hard copy passwords are changed when the live passwords are to avoid confusion. During a disaster or critical event you do not want to find that you really don't have the password.
If you work with someone who possesses critical passwords or data and they were hit by a truck, does someone have a way to get to the passwords in an emergency. Segmenting the passwords is a good idea, but make sure that there is a process to retrieve them if there is a problem. A public/private key system, such as PGP could be used, and there are a number of commercial applications that can help you manage your passwords. Your business will have to chose the right technology for them, but thinking of the secure storage of passwords is better done earlier rather than later.