Best Enterprise Password Management Solutions For Your Organization

Don’t have time to read this entire Password Management guide? Download as an eBook

Download your exclusive copy of this guide to keep and refer to it at your convenience. Or, if you're ready to dive in, continue your journey below.

• What you have which is the TOTP token
• What you know which is your reasonable to remember primary password

Using this strategy, you can have confidence your password manager carries a baseline level of security that in practice is very resistant to most forms of attack.

As an enterprise, you should offer the password manager to all employees to use. A consistent tool sets a baseline for security that can be expected - and required of - your employees. A good tool should provide these basic capabilities:

• Ability to store any form of passwords and to set good baselines for minimum password complexity
• Ability to share one time use or onboarding passwords/files/etc. securely and not in emails and IMs
• Ability to teach and alert employees to problems in the passwords they are using. Inform them when their passwords are weak, on compromised password lists, or are being manually synchronized
• Ability to share credentials within teams of people both inside your organization and externally to your organization
• Ability to automate the submission and usage of passwords in web browsers and other tools people use on a day-to-day basis
• Ability to auto-generate a complex secure password with a password generator.

A decentralized password manager, wallet, or vaulting solution, like the new Bravura Safe, is a baseline for establishing your enterprise cybersecurity journey that your de-risking initiatives can build upon. You can adopt an enterprise password manager like Bravura Safe as a standalone solution or add it to your existing Bravura Security solution. You can deploy Bravura Safe within a matter of hours to benefit from capabilities such as:

• Synchronization of your directory password with your master password.
  o Continue your least passwords journey to a passwordless state.
  o Ensure your one password is strong.
• Joiner/Mover/Leaver capabilities.
  o Grant people access to Bravura Safe seamlessly as they join your organization.
  o Allow people to access team credentials easily when they transfer through positions at your organization.
  o Ensure business continuity when people leave your organization.
• Promotion into Bravura Privilege.
  o Provide people with simple approaches to promote credentials into Bravura Privilege for more active management.
  o Easily access credentials in Bravura Privilege by clicking links in Bravura Safe to minimize your clicks to access.
  o Securely monitor when people use your keys to the castle to access your golden goose.

Tools like Bravura Safe should not be considered a stepping stone but instead should be considered a foundational piece of your Identity and Access Management journey. Edge and decentralized credentials are going to be around for a very long time. It will be years or decades before people stop using passwords for:

• B2B portals and service engagements between companies.
• B2C portal that your staff are signing up for to consume SaaS hosted services.
• Embedded device credentials. Hopefully not hard coded. But certainly, defaulted and potentially difficult to change.
• Temporary labs, demo environments, etc. that are naturally ephemeral in nature but might be accessed for days, weeks, and maybe months.
  
  
  

2. Federate Access to Password Management Solutions

Once you have established a baseline of access through adopting tools like Bravura Safe, you need to strongly consider federated access to solutions. Federation provides a materially stronger and easier to audit level of protection for your core services.

In a federated ecosystem, the first system is called the Identity Provider, or IDP. The application (or second system) is called the Service Provider or SP, and the message sent between systems is called an assertion. The assertion includes the user’s account name and other pertinent information that the SP needs to create a user session. The assertion is cryptographically signed, so the SP can trust that it came from the correct IDP. An example of federation is when users can use their Gmail account or social media credentials to log into other applications, websites, and resources.

You’ll notice the SP has nothing to do with user authentication. It relies on the IDP to do all of the heavy lifting. The only thing the SP cares about is whether the IDP authenticated the user correctly.

For federation to work at scale, IT and cybersecurity experts needed to develop standards that allow globally distributed systems, likely owned by different organizations, to work together. One of the most widely used is SAML, or Secure Assertion Markup Language. Its latest version, SAML 2, has the advantage of SP-initiated login. It provides a better user experience by allowing them to go directly to the app they want to use without navigating through a portal first.

Then within this single identity provider you can set your authentication baseline requirements such as:

• Minimum MFA factors needed. For example, your federation solution can always require 2 factors as a baseline.
• Passwordless authentication options that might be as simple as “email a link to authenticate”.
• Biometric authentication option that also factors into a passwordless journey.
• Risk adjusted authentication. Ask for additional factors to prove identity if authentication attempts appear risky.
• Options for when your users forget or lose authentication factors (passwords, phones, hardware tokens, etc.) and need to get them reset.

Federation is now extremely common in most enterprises. But you need to strategize about where you apply it first. It’s not free and requires configuration to be done with the applications and services you need to protect. So, what should you protect first? Bravura Security would recommend you focus on them in this priority order:

1. Your SaaS applications.
   a. Your first focus. Make sure Salesforce, Workday, Bamboo, Zendesk, Gitlab, GitHub, Jenkins, Bravura Safe, etc are secured. You must invest here.
2. Your IaaS environments.
   a. IaaS platforms like Azure and AWS hold your golden gooses. Protect them. It’s worth the investment.
3. Your zero trust networks.
   As people migrate away from vpns and towards zero trust networks, start yourself off on the right foot. Invest as you transform your networks.
4. Your on-premises networks accessible over vpn.
   Often these are guarded with 2fa options such as password and a machine key already. Invest if it makes sense. But if you are starting a zero trust network journey it might not be worth it.
5. Your on-premises applications.
   Many companies are working towards SaaS applications and removing on-premises applications. Balance the cost of configuration with other options such as directory password authentication and Bravura Safe for less sensitive applications or those with a limited lifespan.
   
   

3. Privileged Access Password Management

Solutions like Federation and Bravura Safe focus on authenticating your users when they have standing privileges in an environment. A standing privilege is an account that exists in your enterprise with the level of access needed to complete a task that an employee can use anytime.

It’s inevitable that you have large amounts of standing access in your organization. Examples include:

• User access to salesforce for your sales employees.
• Access to Google and Microsoft communication platforms.
• Instant messaging platforms.
• Support and services platforms.
• Product and project management platforms.

But some applications are too critical to allow people to have standing access rights to them. In these cases, you want to provide people with just in time access to these solutions. That way you can move towards both a least passwords strategy as well as a least trust strategy.

Privilege Access Management platforms like Bravura Privilege work on a fundamental premise. Remove employee access to long lived credentials and broker their access with temporary entitlements. But what does this all mean? Its easiest to explain with a few examples:

• Removal of people’s ability to access vaulted credentials and require them to request access to them. This way they only get the vaulted credentials when they prove to an authorizer they need them.
• Periodically rotate credentials on a schedule. That way if people do store them, they become invalid after a period of time.
• One time use passwords. Ensure passwords are changed after they have been used.
• Remove passwords entirely and broker peoples access to systems using SSH keys being added and removed from systems as needed.
• Remove needless additional accounts by giving people a single personal admin account which leverages one time use passwords and access brokering. This can really benefit with auditing employee access.
• Just in time add people to groups so they can use their existing directory accounts - temporarily - as administrative accounts on platforms and endpoints.

All of these are proven and industry adopted approaches to minimize the passwords employees need. Each of these materially improves people’s least password journey by simply removing standing and static passwords from the equation.

A common additional level of security is access brokering both through secured client-side disclosures as well as proxy approaches. The most secured systems and access result in an employee never wanting the password. Just press a button and they have access. Getting access to the password becomes an inconvenience for the user when done properly.

Credential brokering and one time use credentials requires deeper integrations with platforms due to the nature of the problem. As such, this solution is often implemented for standardized production environments and popular services.

Examples where companies are routinely succeeding with these strategies include:

• Managing built in credentials to operating systems. Administrator on Microsoft Windows. Root on Linux. SA in SQL server
• Managing credentials reserved for help desk operations that might be deployed out to a fleet of windows and Linux machines
• Administrative credentials in well-known SaaS platforms

Back to top