Though all IT organisations in the Middle East show serious interest in tightening security controls; when it comes to securing the privileged passwords, IT professionals seem to be not paying much importance, and are following flawed practices, according to V Balasubramanian, Marketing Manager (IT Security), ManageEngine.
Real-time IT Management company ManageEngine’s interaction with a cross-section of the visitors at GITEX Technology Week, 2014,underway at Dubai, reveals that organisations concentrate more on perimeter security and tend to ignore the most important aspect of privileged passwords security, which is fundamental to information security.
More than 70% of the respondents said that they were storing administrative passwords, which grant unlimited access to IT assets, in plain text on volatile sources such as sticky notes, spreadsheets, printouts, and text documents. Thirty-five percent of the respondents said that they were either using the same password on many IT systems or were alternating a set of existing passwords on different systems.
More than 40% of the respondents said that they were frequently sharing passwords among technicians through emails and phone calls. Only 9% of the respondents said that they were changing the passwords of their IT systems once a month. Others were allowing passwords to remain unchanged for an extended period, though they change them at their own convenience. 90% of the respondents said that they were conducting only manual audits to check if IT systems have been assigned with weak or factory default passwords.
Such flawed password management practices could make the organisations a paradise for hackers, both inside and outside the organisation. Many security incidents and data breaches actually stem from lack of adequate password management policies and internal controls.
Identity theft often lies at the root of modern-day cyber attacks. To gain access to IT resources, cyber criminals use various techniques, including phishing attacks and obtain employee login credentials and administrator passwords. As organisations are drowning in an ever-increasing number of passwords, the risks involved are quite high. Especially, passwords kept on spreadsheets result in a host of security issues. Here are some high-risk factors and scenarios:
– Unrestricted or uncontrolled access — There is rarely any internal control on password access or usage. Technicians get unrestricted access to all the passwords.
– Unaudited access with no trace of “who” accessed — Privileged passwords remain impersonal in shared environments. Mistakes, whether accidental or deliberate, can never be traced to the offender. There is generally no way to track “who” accessed “what” and “when.” This allows people to remain unaccountable for their actions.
– Temporary access becomes permanent — Passwords are given out orally or by emails to users who need a privileged password on a temporary basis. Such a practice can be huge security hazard when there is no process to revoke temporary access and reset the password after usage.
– Technician leaves the organisation, takes the passwords — When a technician leaves the organisation, the technician may take a copy of all the passwords. The only solution to such a scenario is to change all the privileged passwords of all the clients.
– Passwords fall into malicious hands — If the text file or spreadsheet containing the administrative passwords reaches a malicious individual, client networks could be in jeopardy.
– Passwords remain unchanged for long periods of time — Passwords of even the most sensitive resources like firewalls remain unchanged to prevent lockouts. Manually changing the passwords of thousands of resources can be time-consuming. Worse, most resources are assigned the same, non-unique password for ease of coordination among administrators.
To combat ever-increasing cyber attacks, organizations should focus on securing privileged passwords, controlling and monitoring privileged access, and adopting stringent security best practices. They can easily achieve a high level of security by using privileged password management solutions. In the absence of an appropriate management tool, password management can become quite cumbersome.
