In the recent past, we've seen widely publicized instances of IT staffs abusing their privileges. Right now some organization is unknowingly falling victim to malicious activity by a member of its own IT staff. For these reasons, organizations' internal IT practices are increasingly coming under the scrutiny of auditors. Here, Knowledge Center contributor Udi Mokady provides a checklist of five ways companies can secure and manage privileged identities to prevent IT staff abuse.
the past couple of years, there has been an endless stream of
statistics about insider threat. However, the vast majority of IT
security officers appear to be oblivious to them. So, here's a
stat I guarantee will not be disputed: Right now there is a 100 percent
chance that some organization is the victim of either malicious
activity by a member of their own IT staff or the stubbornness of one
of their company officers.
But forget the stats for a second, and just look at the headlines in
the news. In the past several months alone, we've had instances in San
Francisco, San Diego, Lichtenstein and a host of other instances of IT
staff abusing their privileges. In these cases, the problem is
ultimately due to a lack of control and proper process within the
Privileged accounts can bypass most internal controls to access
confidential information and cause denial of service (DoS) attacks,
either by deleting data or rendering applications inoperable. In many
cases, unauthorized users can use privileged accounts to cover their
tracks by destroying audit data.
In a recent case in San Diego, an IT specialist had deliberately
deleted patient and allied data from his former employer's computer
systems. He now has five years to reflect on his actions but the damage
is done. In San Francisco, a computer network administrator for the
Department of Technology tampered with the network, which contains the
city's sensitive data, and created an administrative password that gave
him exclusive administrative access. Apart from the embarrassing
publicity and inconvenience, the millions of dollars it will reportedly
cost to fix should be enough of a statistic to make you pause for
thought! And, in both cases and so many others, the situation was
easily and inexpensively avoidable.
The challenge is to ensure proper use of these accounts. The
challenge is that shared superuser accounts-which are generally
system-defined in operating systems, databases and network devices-pose
significant risks when the passwords are routinely shared by multiple
users. So, too, do shared fire call accounts, which are used to deal
with critical problems outside normal working hours (when passwords are
managed using fragile manual processes).
Compliance is key; think like an auditor
In the end, it all comes down to internal regulations and
compliance. There is a need for internal processes to manage shared
account passwords in a controlled and accountable way. Home-grown
solutions such as spreadsheets, printouts, sticky notes and envelopes
are old-fashioned. They also don't scale or provide sufficient levels
of security and auditing specifics that today's auditors require. And
if an auditor can spot them, statistically speaking, someone internally
with a little IT savvy will see them as well and take advantage.