NASA Goddard Space Flight Center Soars with Bitwarden

When LINUX systems engineer Mark Miller first joined the NASA Goddard Space Flight Center, NASA Goddard was managing passwords with a tool called Cryptvault. While a ‘good enough’ tool, it was written in ColdFusion (CFML), over 15 years old, and created by a developer who had long departed the organization. It was also locked into one system and had an associated encryption that was written for a limited 32-bit code base. When the time came for NASA Goddard to migrate away from other legacy systems, the IT team started looking for a replacement password management. 

Identifying a secure, holistic way to share secure information and passwords was a critical task for teams at NASA Goddard. While government agencies have always been targets of cybercrime, particularly by nation-state actors, the 2022 SonicWall Cyber Threat Report showed a large increase in all forms of cyberattacks against the U.S. government. And, the link between weak passwords and data breaches is undeniable, with a succession of Verizon Data Breach Reports highlighting the connection. Real-world examples also prove illustrative: just look at SolarWinds and Colonial Pipeline for more evidence.

In the event someone leaves the organization, Bitwarden offers an excellent way to transfer information to the replacement employee. It also created a culture of ‘process’, a huge boon for the IT team. Putting a process into password management means that it becomes second nature for the team, as they grow accustomed to inputting their passwords into the password manager in a coherent and organized fashion. It also obviated the need to save credentials across systems and browsers.

In the future, the team is eager to make use of the Bitwarden SSO enterprise integration. It is also considering whether organization devices - such as phones used onsite - are eligible for Bitwarden. Lastly, it is considering expansion possibilities for other NASA divisions. 

“Passwords are here to stay,” said Miller. “They are not going anywhere. There are just too many service accounts or API keys or other secure credentials that need to be shared within an organization in order to keep that organization operational.”