RE: Password Storage

["Nicholas Fanelli" <nfanelli () empire edu>]

Doug,
We have used this in the past...

http://keepass.sourceforge.net/ 

You can put all your passwords in one database, which is locked with one
master key or a key-disk. So you only have to remember one single master
password or insert the key-disk to unlock the whole database. The
databases are encrypted using the best and most secure encryption
algorithms currently known (AES and Two fish).

Nicholas J. Fanelli

-----Original Message-----
From: Doug W [mailto:dougiegee () hotmail com] 
Sent: Tuesday, August 01, 2006 11:12 AM
To: security-basics () securityfocus com
Subject: Password Storage

Hi Everyone

What do people generally do in the case of password storage?  For
example, I 
strongly believe that storing passwords in documents is a terrible idea
as I 
am sure you would agree.

However, how do you account for having multiple support staff, possibly 
working off site, most with extremely bad memories (unfortunately), and
in 
need of high level rights to fix systems etc.

I also try to enforce that all actions are taken wtih the users own 
privileged account for auditing purposes but when building machines, 
installing software or troubleshooting problems, service accounts and 
administrations accounts may be required.

Or, is this problem more universal than I think and forcing people to
not 
document passwords will be an interesting challenge?

D



------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic
Excellence 
in Information Security. Our program offers unparalleled Infosec
management 
education and the case study affords you unmatched consulting
experience. 
Using interactive e-Learning technology, you can earn this esteemed
degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---
 
CONFIDENTIALITY NOTICE:  This communication may contain privileged and/or confidential information. It is intended 
solely for the use of the addressee. If you are not the intended recipient, you are strictly prohibited from 
disclosing, copying, distributing or using any of this information. If you received this communication in error, please 
contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This 
communication may contain nonpublic personal information about consumers subject to the restrictions of the 
Gramm-Leach-Bliley Act. You may not directly or indirectly reuse or redisclose such information for any purpose other 
than to provide the services for which you are receiving the information.

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------