Forum Discussion

amj729's avatar
amj729
New Contributor
2 months ago

Issue: Account Owner Permissions & Vaults

Firstly, I want to share that this issue/concern was raised by my company's infrastructure leaders and cybersecurity/information security leaders while discussing rolling out 1Password for our global IT teams.

Issue/Concern: 1Password account "Owners" have full permission to manage ANY vault and their vault access cannot be restricted. Therefore, they can add and remove themselves or anyone in the organization to any vault, at any time, without any guardrails.

Why is this a problem?
As many organizations, we have a broad IT department broken out between application teams, security, cloud and on-premise infrastructure teams as well as deskside and helpdesk support. Our IT teams have a separation of duties for operations and security reasons. Therefore, whoever is a 1Password "Owner" should not be able to see highly sensitive passwords, API keys, etc of another team. So if our cybersecurity/infosec team does not have access to make administrative changes to our server infrastructure but they are supposed to manage the access at the highest level for our 1Password account, should they be owners? What if one owner assigns themself to a vault with sensitive passwords that should only be accessible to our server team?

What we found

  • 1Password does not provide native email alerts to notify all 1Password Owners/Administrators when an employee is added or removed from a vault. This would be a great feature at least for 1Password Enterprise accounts.
  • There is no ability to remove the "Owners" group from a vault if the "Manage Vault" permission is granted to a different group. (e.g. A group with only the server team managers and/or director)
    • But if an "Owner" can't manage every vault, then what if the non-owner group member(s) lose access to 1Password or leave the organization? Answer: An Owner or other authorized 1Password Administrator recovers their account or the vault is lost permanently with the only option for it to be deleted by an "Owner". -- Yes, an enterprise will need to accept this risk but they should be offered this level of granularity for certain password/credential security use cases!
  • Shared vault credentials and other data are not secure enough for use within our IT teams with the current and only available way of structuring shared vault permissions with "Owners".
  • Shared vaults are useful for non-IT teams for internal team account sharing. (e.g. Marketing, sales and social media teams)

Conclusion
We do not feel comfortable using 1Password as our exclusive password management solution due to the lack of available permissions that essentially allow the Owner(s) to elevate their shared vault permissions with no available native 1Password platform warnings, alerts or options to implement guardrails. I hope this drives a strong discussion and would be happy to speak to 1Password leadership on this topic in a private meeting as the only available solution is what is outlined in the link below which was also the only recommendation by a 1Password solutions architect. Due to this lack of permission granularity, our IT teams do not feel comfortable using shared vaults.

https://www.1password.community/kb/1password-launch-kit/setting-up-1password-for-large-organizations/687

discussion

7 Replies

Sort By
  • 1P_SimonH's avatar
    1P_SimonH
    Icon for Community Manager rankCommunity Manager
    29 days ago

    Just as an addendum, amj729 and Sergg, I have submitted a feature request for this functionality and added your votes to it.

  • 1P_SimonH's avatar
    1P_SimonH
    Icon for Community Manager rankCommunity Manager
    30 days ago

    Hi amj729,

    I'm doing to send you a private message here in the community to follow up on this. Stay tuned! 

  • Tom's avatar
    Tom
    Dedicated Contributor
    30 days ago

    1P_danielor 1P_SimonH could you help answer and/or tag some potential candidates for helping answer out of the 1password-admin-users group to answer here in the general section?

  • Tom's avatar
    Tom
    Dedicated Contributor
    30 days ago

    Late to the party, but seeing Sergg 's reply; the way we solutioned that in one of my previous roles at another company was to retain a single 'owner' account (behind lock & key) and create various 'administrator' roles for everything else. We also instated specific 'team admins' to cater for their respective vaults/groups. Potentially when an elevated 'team admin' would leave and no committment was to be expected the 'owner' account details would be retrieved and used.

    In a large organisation relying on team admins might not be the IT's most straight-forward approach but it does enforce the championship approach and self-awareness of security in the various teams. Also it prevents IT from having (mostly) anything to do with passwords in suchs vaults, while - using the reports and watchtower functionality still are at the grasp for IT to 'meta' monitor things.

    While 'less ideal' I do think it ensures a better way of handling security within teams than having IT being responsible for everything. I do concur that an improved way should be available from 1Password, though one should challenge the way IT would 'want' to be involved with departmental passwords to begin with. (Especially given the side-note that IT can both access the 'recover user' and 'copy user's mail to another address' wich will give them full control of any users data - which in a family account is 'do-able' but cumbersome as one has to handle the mail-address as well. As a family admin I can start recovery but can not change their mail).

    • amj729's avatar
      amj729
      New Contributor
      30 days ago

      Hi Tom  -- Thank you for your response. We want to be able to have our IT team leaders champion their own vaults, but the issue still remains that the "big brother" Owner account remains locked to "enabled" for every vault. I think the best solution is for 1Password to allow business/enterprise customers the ability to remove the "Owners" group from vault permissions. See the attached screenshot.

      If 1Password doesn't want to make this a GA feature for business/enterprise accounts, this should be available to be unlocked through a special request process where the risk can be accepted. We would still want the Owner group to be on vaults that are not highly sensitive, so maybe giving only Owners the ability to remove the "Owners group" from a vault as long as there is another team manager assigned as the vault manager.

  • Sergg's avatar
    Sergg
    New Contributor
    30 days ago

    Hello, I have a similar concern. Have you heard anything back? P.S. Thank you for a detailed write-up.

    • amj729's avatar
      amj729
      New Contributor
      30 days ago

      SerggI received another response to the post this morning but I still have not heard anything back yet from the 1Password team.