Release It! - Chapter 12.2 Configured Passwords

Passwords are the Achilles heel of application security. Any password that grants access to a database with customer information is worth thousands of dollars to an attacker and could cost the company thousands in bad publicity or extortion. These passwords must be protected with the highest level of security achievable. At the absolute minimum, passwords to production databases should be kept separate from any other configuration files. They should especially be kept out of the installation directory for the software. Files containing passwords should be made readable only to the owner, which should be the application user. Password vaulting keeps passwords in encrypted files, which reduces the security problem to that of securing the single encryption key rather than securing multiple text files.  Consider using Tripwire to monitor secured files.   Keeping passwords safe is a pain but I suppose it is better than letting the bad guys at your customer's data.