Sending it by encrypted email provides mitigating control, but since there's resistance in your organization, that's...
not an option. And, for the same reason, using another encryption scheme, like public key infrastructure (PKI), to store the password might be overkill, especially if the vendor who needs the password or the project itself is small. The expense and time in implementing PKI could cause further resistance in your organization.
As for posting it on your Web portal, even if such a portal were hardened, secured and password protected with multifactor authentication, there's always a risk that the Web site could be breached and the password exposed.
With snail mail, however, the only way someone could steal the passwords would be if they had physical access to the corporate mailroom. Though mailroom security may vary from company to company, it's still relatively more secure than anything online.
The other question to ask is whether you're issuing the same password to all of your vendors that need this firewall access. Each vendor should have their own unique password. Depending on the firewall, you should be able to configure it to allow access for multiple accounts. Otherwise, if the same single password is stolen from one vendor, this represents a single point of failure from an information security perspective since, then, all your vendors have been breached.
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Joel Dubin
After a server room door has been compromised, finding a more secure solution is of utmost importance. Learn how to choose a server room door that ... Continue Reading
In the IAM world, what's the difference between access control and identity management. This IAM expert response explains how the two relate as well ... Continue Reading
When working with PeopleSoft and Unix, which single sign-on (SSO) vendors offer the most effective products? Learn how to choose an SSO product in ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.