Secure automation of adding credentials
Dear Devolutions,
Recently we started to use credentials in RDM. Currently when new credentials are introduced or credentials are changed by colleagues, we are emailed with the new credentials which we adding manually in RDM. Because the company is ISO certified, this process is deemed not secure.
We are thinking of developing a webportal, were colleagues can generate credentials. If the credential is accepted, it is passed to RDM and automatically added (at first in a general folder, were we can check the credential for completeness.) Some of the colleagues are part of a project team. They have no access to RDM.
What ways are there available to pass the credentials from the web portal to RDM in a secure manner? End to end security/encryption would fit best for the ISO certification.
Thanks in advance for assisting us with this question.
Kind Regards,
Valid Operations.
All Comments (4)
Hi,
I'm not an ISO expert but I think that you're web portal could execute a power shell script to insert the credentials into the RDM database. What do you think?
Regards
David Hervieux
Hi,
Thanks for your reply. The idea of the web portal executing a powershell script could work. However, is there a way to "hash" the passwords so they cannot be retrieved from the powershell variable in case the system is compromised. I have seen some sort of powershell commands to scramble the password, but that is only when the password is hardcoded i thought.
Hi,
Perhaps you could load the password from a file encrypted with DPAPI
https://social.technet.microsoft.com/Forums/en-US/1d1ac4cb-0358-41ad-aec9-ad74b3ad714f/storing-encrypted-strings-dpapi-clarification?forum=winserverpowershell
David Hervieux
That would be an option:) Thanks for the suggestion!