Today’s Biggest IT Security Menace and 6 Ways to Fight It
by Calum MacLeod - Cyber-Ark - Wednesday, 9 May 2007.
3. Apply Change Policies to Privileged Passwords

This may sound obvious, but you’d be surprised how often policies for privileged passwords are not as explicit as those for their human counterparts. For instance, you may now change the password on your laptop every 30 days, however surveys show that workstation has a 20% chance of NEVER having had the Administrator ID changed from its default (Source: Cyber-Ark Enterprise Privileged Password Survey.) In other words, if you lost your laptop, the finder may not know who you are or what company you work for… but they can search the web to find the default Administrator password that ships with a Dell Latitude D600. Within seconds, your laptop’s new owner will have more access to your systems than you do.

We suggest having an explicit policy that names all the password types uncovered during your privileged password internal survey and spelling out update policies for each. Best practices dictate that these policies are at least as stringent as those for individual employees.

4. Make Sure Privileged Passwords are Stored Securely

Again, this may seem obvious but it is imperative that organizations store their privileged passwords in the most secure vaulting system available. Placing the passwords in sealed envelopes, locked binders, within an encrypted file or on wallet-sized cards are NOT acceptable alternatives (and yes, I have seen all of these in use at real-world enterprises.)

5. Create a Staged Approach to Deployment

Privileged passwords are literally the keys to your kingdom and must be controlled properly. One common stumbling block for projects around privileged passwords is that once the password inventory is created, the sheer volume and prevalence of these codes is overwhelming. Personnel can say: ”we never secured these before so why bother now?“ In these situations, the most successful auditors take a deep breath, drink a tall latte and start putting together a stepped plan with reasonable deadlines, deliverables and consequences.

6. Remember computers are people too

While 99% of enterprises change passwords for employees, up to 42% never change hard-coded and embedded passwords for application IDs, testing scripts and batch jobs. (Source: Cyber-Ark Enterprise Privileged Password Survey.) According to Mark Diodati of the Burton Group, this creates an App2App password problem that is ”exponential. For example: 300 hosts x 2 applications per host x 5 scripts per application = 3000 stored passwords.“ Often, these passwords are in clear text and readily available to every developer or database administrator in an organization.

All in all, no privileged password management system is complete without an App2App component. However, since application passwords are stored in scripts that must be re-coded, tested and deployed, most organizations I work with break out fixing past code from making future mistakes. Once again, a stepped plan can be your best friend.

One final note: no policy for managing privileged passwords would be complete without related reporting structures. Audit reports for privileged passwords often cover such topics as when passwords are updated, any update failures and which individual identities performed tasks under a shared account.

So there you have it, the greatest threat now posed to IT security is due to the smallest of things, a tiny code embedded in virtually every piece of hardware and software. However, armed with a strong plan and the knowledge you’re protecting your organization, any auditor can become a successful warrior against today’s top IT security threat.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th