By Matthew McKenna, SSH Communications Security
What would happen if someone got a hold of your organization’s master password?
This password never expired and was essentially untraceable, granting the person access to your organization’s critical systems and sensitive information.
Would this make you nervous? Of course. Now imagine that this has been the case for a decade. Would you have a serious meltdown?
If so, you would be justified in your concern.
What’s worse, this is already happening today in our networks through the use of SSH user keys. These keys have largely been forgotten because really, who in your company is responsible for SSH?
It is an encryption protocol that has existed for the last 20 years, quietly doing its job efficiently and effectively.
However, it is the source of the most critical form of access into our networks.
- IT administrators use the SSH protocol to remotely access operating systems, application databases and network devices.
- It is used by developers to access systems and move code between various systems and into cloud environments.
- It is used to securely move data between applications, both on premises and to our clouds.
- It is used by our vendors and outsourced managed service providers to maintain our systems.
Perhaps the most worrisome application of the SSH protocol comes from hackers and malicious insiders; it is their preferred method to move laterally throughout our networks.
Overlooking the Obvious
Most security executives do not have a full appreciation of the power and degree of access that the SSH protocol provides.
If we think about the likes of Snowden, Sony and Target, in each of these cases, there is sufficient evidence pointing to the use of SSH user keys to gain access to critical systems and ex-filtrate data.
Though breaches occur for a variety of reasons and via many methods, the fact is that 100 percent of breaches are caused by a compromise in privileged credentials.
Shouldn’t we therefore take particular notice of credentials like SSH user keys, which are the only form of access that can be provisioned without oversight, don’t expire and aren’t linked to an identity?
However, because the impact is so pervasive and all-encompassing across our networks, it is something that we are reluctant to take up to the C-suite and say, “Folks, we somehow forgot about this one over the last 10 years.”
It’s unfortunate, and short-sighted, that journalists and security executives have often been reluctant to escalate the topic of SSH user key-based access.
The most common response is, “Well, I need a smoking gun to act on this issue.”
But the smoking guns and evidence are overwhelming. Common sense and our common objective as security professionals to continuously decrease risk should guide us first on this one.
If enterprises have no idea who SSH user keys belong to, how would they know if the keys were the privileged credential source that caused the data breach?
If enterprises don’t have an inventory of them, are not monitoring them and don’t have a governance process regarding their provisioning, de-provisioning and recertification, how could they know? They wouldn’t, and they couldn’t.
This is why the biggest blind spot in our security postures today is SSH.
It grants access to our most critical systems and network infrastructure.
Our traditional layered security concepts are blind to what goes on inside the encrypted sessions. It is a gap inside the majority of identity governance administration programs today.
Creating Visibility
Security today requires more than saying our PKI team controls SSH keys or that our Privileged Access Management team has the lead on this.
The fact is that they don’t really have it under control. This issue encompasses all aspects of identity governance today within our environment.
Here are some of the important questions your organization needs to answer:
- Do we have visibility and accountability of ownership for all SSH user key-based trusts in our environment both on premises, in our cloud and to our network devices?
- How is SSH user key-based access provided, de-provisioned and recertified for both human use and application-to-application connections?
- Are we monitoring SSH user key-based connections?
- Are we aware of cross-platform connections between Windows, Unix and Mainframe where SSH user keys are being used?
The bottom line is that our network security is seriously suffering due to the mismanagement or non-management of SSH user keys.
Enterprises need to establish accountability for all credentials providing access to their systems.
These keys are like passwords on steroids, granting access to the core of a company’s digital assets. That creates a dangerous and potentially disastrous blind spot that must be remediated.
(Learn More & hear from the Author, courtesy of SSH Communications Security and YouTube)
About the Author:
Matthew McKenna brings over 15 years of high technology sales, marketing and management experience to SSH Communications Security and drives strategy, key account sales and evangelism.
His expertise in strategically delivering technology solutions that anticipate the marketplace has helped the company become a market leader.
SSH Communications Security is a leading provider of enterprise cybersecurity solutions. Our solutions enable, control, and audit trusted access in critical environments.
Our technology secures the infrastructure of your digital life. The servers, the data. We are present in over 90% of all data centers in the world – on-premise and in the cloud.
More than ever, the physical world we live in also depends on computers. Retail, banking, transportation, government, military, and everywhere in the critical infrastructure.
