The backbone of every enterprise infrastructure is a massive network of servers, network devices, and security and other infrastructure that creates the complex communications network, or nerve centre, of a company. Every day, systems, network and security administrators are logging onto these critical infrastructure points for routine maintenance, repair and application of the most updated security patches. Many of them are running around with "root" and "administrator" privileges, either with their personal user or with their commonly used accounts. And they’re losing or forgetting them all the time!
Administrators, like most of us, have the best of intentions, but the more those passwords exchange hands or remain unchanged, the greater the likelihood of a security breach. Also because administrative passwords frequently need to be shared, there is increased risk that they are just left lying around somewhere. This results in administrative passwords becoming widely known and changed less frequently. Since administrative privileges are required for emergency and disaster recovery scenarios, only a reliable password management policy can guarantee that the correct passwords will be promptly available in these time-sensitive circumstances.
It’s surprising how many organisations resort to storing passwords simply around the office on spreadsheets and simple databases. A quick penetration test will show just how easy it is to get at these documents. Mismanagement of administrative passwords is a major cause of security breaches and one of the top reasons for long recovery processes from IT failures.
The problem would be easy to fix if large organisations didn't demand near-instant access for administrators struggling to keep up with crashes and maintenance, or only employed female administrators. But since this is unlikely to change, companies have to look closely at the way passwords are saved, controlled and managed.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.