I'm in a small enterprise environment, a dozen or so developers, no full time QA specialist, no dedicated testing resources. Project leads and developers and subject matter experts all contribute to test case development, and test cases are executed by developers, subject matter experts, business staff who will ultimately use the software in production, etc. We execute our tests in various non-production environments, but, most of our non-production environments are populated with actual data from production. Our test case management tool is behind our perimeter firewall as are the non-production application systems under test.
Since a variety of people can execute test cases, testing is more convenient if our test case instructions are very explicit, i.e., login to https://.../login with username "BOB" and password "TESTING789!2015" ....
However, explicitly revealing login credentials, even to a test application, is a questionable security practice, and in our situation, the system under test does contain a copy of production data so it does contain genuinely confidential data. (Note the staff that we select to execute tests are staff who are authorized to see confidential data in production, but, the test management tool authorizations probably aren't managed with the same diligence with which we would manage production system authorizations, so there is potential for the test case credentials to provide a vector for unauthorized staff to login to the test system and see the test system copy of confidential data.)
Alternatives as I see them include:
1) Write test cases for convenience of testers, explicitly revealing credentials, and manage authorizations to the test case instructions to minimize the security risk. (Accept the risk that authorizations to the test case management tool probably aren't managed with the same diligence as the actual production systems.)
2) Write test cases without credentials, i.e., "supply valid username", "supply valid password", and use telephone or sneakernet to distribute passwords, and accept the risk that testers will write down passwords, and accept the risk that testers will be less willing to cooperate with testing efforts, but, possibly reduce testing-induced security risk.
3) Use shared "lastpass" or "password safe" mechanisms to distribute test case credentials, requiring testers to deal with additional complexity, and accept the risk that testers will be less willing to cooperate with testing efforts, but, possibly reduce testing-induced security risk.
What alternatives am I overlooking?
What do other organizations do about credentials in test instructions?