Security Management Strategies for the CIORequires Free Membership to View
Sending it by encrypted email provides mitigating control, but since there's resistance in your organization, that's not an option. And, for the same reason, using another encryption scheme, like public key infrastructure (PKI), to store the password might be overkill, especially if the vendor who needs the password or the project itself is small. The expense and time in implementing PKI could cause further resistance in your organization.
As for posting it on your Web portal, even if such a portal were hardened, secured and password protected with multifactor authentication, there's always a risk that the Web site could be breached and the password exposed.
With snail mail, however, the only way someone could steal the passwords would be if they had physical access to the corporate mailroom. Though mailroom security may vary from company to company, it's still relatively more secure than anything online.
The other question to ask is whether you're issuing the same password to all of your vendors that need this firewall access. Each vendor should have their own unique password. Depending on the firewall, you should be able to configure it to allow access for multiple accounts. Otherwise, if the same single password is stolen from one vendor, this represents a single point of failure from an information security perspective since, then, all your vendors have been breached.
This was first published in September 2006
Join the conversationComment
Share
Comments
Results
Contribute to the conversation