Post reply

Password Guidance

  • September 10, 2025 at 12:00 am

    #4644714

    Comments posted to this topic are about the item Password Guidance

  • September 10, 2025 at 8:21 am

    #4649248

    My company uses BitWarden as a central password manager.  This can generate random, strong passwords or pass phrases of whatever length or complexity is required.

    We have personal vaults and company vaults.  The company vault has areas that have break-glass access and others that are locked down to a handful of individuals.

    BitWarden entries can also include attachments such as public/private key pairs.  It also allows the use of TOTP tokens to provide MFA.

    The advantage of this is that we don't need a plethora of authenticator apps installed on personal devices.  People who leave the company lose access to the company's BitWarden.

    For some systems, we generate a public/private key using Terraform.  We use SnowflakeDB, so when a service user is created, the public key is attached to the user and the private key gets stored as a secret wherever it is needed.  If the service user is for a CICD pipeline in GitHub, then this would be stored as a GitHub organisational secret.  Human interaction is unnecessary, and knowledge of those keys is not needed.

    If we have other service users, then, temporarily, we will have Terraform write the key to files and store those files as attachments in BitWarden.

    We have security scanning to make sure that keys and cloud credentials are not stored in GitHub.  We have .gitignore entries for most of that as a 1st line of defence.

    Snowflake also encourages us to use passkeys.  I need to learn a lot more about these, though I have been told they are more secure than MFA.

    We use OIDC to allow systems external to our AWS infrastructure to authenticate by assuming an AWS IAM role.  That role has strict IAM policies on who or what is allowed to assume that role.  An example where this is used is where a specific GCP Cloud Function wants to send a message to an AWS SQS Queue Topic supporting centralised alerting.

    LinkedIn Profile

  • September 10, 2025 at 1:17 pm

    #4649387

    I'd love to hear more responses to this, just because it relates to a current project I'm undertaking to update our environment's credentials.

    My effort is centered around 4 points:

    1. Reduce permission levels - before I arrived, many logins were given elevated permissions (especially sysadmin) because then they could be sure it would work.  In some cases this is easy to turn down to the appropriate level, in others it is quite challenging.
    2. Change all SQL login's passwords - we had some that were over 10 years old, and there are some that were stored out in plain text in file systems. Along with changing them we are enforcing complexity and age requirements.
    3. Disable then drop unused logins - this is again tough to figure out when there is no documentation.  I ended up doing a 6 month login audit to find what is likely no longer needed and it was a majority of what was out there.
    4. Switch from SQL logins to AD auth - this fits with MS guidance and is easier for me to manage and far more secure.

    To date most of points 1, 2, and 3 are complete and 4 is in progress.  It has been a rather painful process as I make breaking changes then have to make adjustments.  But the results have been very satisfying for me.  The biggest challenge has been trashy 3rd party software.  After asking how to change their database login's password, here's a short quote of guidance I got from one vendor just last week:

    [Vendor]’s expert opinion is to do nothing and leave the passwords the same.

    *sigh*

    Be still, and know that I am God - Psalm 46:10

  • September 15, 2025 at 11:53 pm

    #4652450

    If you have a lot of systems/accounts or have compliance/regulatory requirements, there are existing PAM solutions (Privileged Access Management):

    https://www.gartner.com/reviews/market/privileged-access-management

    You can even go as far as recording a user's session.

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply