Today’s Biggest IT Security Menace and 6 Ways to Fight It
by Calum MacLeod - Cyber-Ark - Wednesday, 9 May 2007.
What is today’s biggest IT security threat? IT itself, according to recent reports from IDC and Carnegie Mellon/DoD. To begin with, IDC research finds that enterprise companies rank insider sources as their top security threat (Source: ”Privileged Password Management,“ Sally Hudson, IDC). In addition, research from Carnegie Mellon University for the Department of Defense (DoD) finds that when it comes to insider attacks, 86% of perpetrators held technical positions. Of these, 57% performed the attack after termination. (Source: Management and Education of the Risk of Insider Threat (MERIT), CERT3 Program, Software Engineering Institute and CyLab at Carnegie Mellon University.)

Both reports found that insider attacks result in costly outages, lost business, legal liability and, inevitably, failed audits. In one case study, it took 115 employees 1800 hours to restore data deleted by a disgruntled insider. At the time of the attack, the perpetrator was an ex-employee of the IT department who was able to remotely access key systems. According to these reports, IT insiders commonly acquire and maintain powerful system access even after termination by using privileged accounts and passwords.

Privileged passwords have become a real concern for auditors and enterprises and here are six of the best practices that we’ve found are the best way to battle with this menace.

1. Create an Inventory of Privileged Passwords

Privileged passwords are the non-personal, shared passwords that exist in virtually every device or software application in an enterprise, such as root on a UNIX server, Administrator on a Windows workstation, and an Application ID used by a script to connect two databases. Many companies begin the process of securing their privileged passwords by taking an inventory of how many exist and how often they’re updated.

In this effort, it is important to note that privileged passwords exist in many places within your enterprise, such as:
  • Administrative accounts that are shared by multiple IT professionals and come predefined by the manufacturer. These include UNIX root, Cisco enable, DBA accounts, Windows domain and so on.
  • General shared administrative accounts, such as help-desk, fire-call, operations and emergency accounts.
  • Hard-coded and embedded application accounts, including resource DB IDs, Generic IDs, batch jobs, testing scripts and application IDs.
  • Service accounts such as Windows service accounts and scheduled tasks.
  • Personal computer accounts, including the Windows Local Administrator on laptops and desktops.
Today many organizations still manually update these passwords, if they change them at all. For example, a recent study showed that 42% of application passwords are never changed (Source: Cyber-Ark Enterprise Privileged Password Survey.)

2. Define the Role of Identity and Access Management (IAM)

When it comes to managing privileged passwords, a common first mis-step is to import all Administrator or Shared IDs into a system built for managing human identities. The benefit of this approach is that you can quickly start to automatically update your organization’s privileged passwords. The negative? Your organization still has no way of assigning individual responsibility. For example, the reports will show that the “Administrator” identity downloaded your database of top clients at 1:47 AM Sunday morning. You won’t be able to tie that action – or its consequences -- to a particular individual.

To deliver true accountability, your system for Privileged Password Management (PPM) must tie individual identities to shared accounts. This is incredibly sensitive data – a hacker’s dream list of all your privileged passwords – so this information must be stored in an exceptionally secure place. IAM solutions are not designed to store sensitive data and typically partner with a PPM solution for the privileged accounts/passwords.


What's the real cost of a security breach?

The majority of business decision makers admit that their organisation will suffer an information security breach and that the cost of recovery could start from around $1 million.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 11th