eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Over the past couple of years, there has been an endless stream of statistics about insider threat. However, the vast majority of IT security officers appear to be oblivious to them. So, here’s a stat I guarantee will not be disputed: Right now there is a 100 percent chance that some organization is the victim of either malicious activity by a member of their own IT staff or the stubbornness of one of their company officers.
But forget the stats for a second, and just look at the headlines in the news. In the past several months alone, we’ve had instances in San Francisco, San Diego, Lichtenstein and a host of other instances of IT staff abusing their privileges. In these cases, the problem is ultimately due to a lack of control and proper process within the organization.
Privileged accounts can bypass most internal controls to access confidential information and cause denial of service (DoS) attacks, either by deleting data or rendering applications inoperable. In many cases, unauthorized users can use privileged accounts to cover their tracks by destroying audit data.
In a recent case in San Diego, an IT specialist had deliberately deleted patient and allied data from his former employer’s computer systems. He now has five years to reflect on his actions but the damage is done. In San Francisco, a computer network administrator for the Department of Technology tampered with the network, which contains the city’s sensitive data, and created an administrative password that gave him exclusive administrative access. Apart from the embarrassing publicity and inconvenience, the millions of dollars it will reportedly cost to fix should be enough of a statistic to make you pause for thought! And, in both cases and so many others, the situation was easily and inexpensively avoidable.
The challenge is to ensure proper use of these accounts. The challenge is that shared superuser accounts-which are generally system-defined in operating systems, databases and network devices-pose significant risks when the passwords are routinely shared by multiple users. So, too, do shared fire call accounts, which are used to deal with critical problems outside normal working hours (when passwords are managed using fragile manual processes).
Compliance is key; think like an auditor
In the end, it all comes down to internal regulations and compliance. There is a need for internal processes to manage shared account passwords in a controlled and accountable way. Home-grown solutions such as spreadsheets, printouts, sticky notes and envelopes are old-fashioned. They also don’t scale or provide sufficient levels of security and auditing specifics that today’s auditors require. And if an auditor can spot them, statistically speaking, someone internally with a little IT savvy will see them as well and take advantage.
How to Prepare for Your Next Audit
How to prepare for your next audit
No matter what sector or industry you belong to, the point of an audit is to use your policies and test their effectiveness. Improper policies will result in non-compliance, and certainly not adhering to the policy will result in non-compliance-not to mention a higher risk of having your company’s name pop up on the front page of the newspaper over a data breach.
Responsiveness to auditors’ requests demonstrates effective controls, so it is essential that an organization has the processes in place to ensure timely responsiveness. Don’t keep your auditor waiting. Delaying or not responding to audit requests will result in a failure, and precious resources will fly out the window in the form of lost time and money.
So, what is the auditor going to be looking for, and how can you be prepared? The following are three tips I have found valuable:
Tip No. 1: Make sure that you have an automated reporting system. Writing changes on paper are not going to be well received.
Tip No. 2: Categorize your systems based on their criticality and the sensitivity of the data that may be stored.
Tip No. 3: Ensure that you are able to prove that your policies allow for the following: Passwords can be automatically changed on a regular basis corresponding to a set interval (for example, every 60 days); passwords can be automatically changed when requested; passwords can be changed automatically after a short amount of time after checkout (for example, 30 minutes); passwords are changed automatically between each usage and that, if required, only one person at a time can have access; and the ability to show that you are able to verify the passwords on a regular basis to ensure that no unauthorized changes to a password has occurred.
One statistic that I can be sure about is that there is a 100 percent chance that some organization somewhere is currently suffering from improper use of their systems due to the misuse of privileged accounts. And sooner rather than later, yet another organization will make the headlines because they didn’t take the necessary precautions to protect themselves. It’s always raining somewhere, so be sure to do everything in your power to protect yourself now before the storm hits.
A veteran of a Military Intelligence unit, Udi holds a law degree (L.L.B.) from Hebrew University in Jerusalem, and is completing the Science of Management Master’s program at Boston University. He can be reached at udi.mokady@cyber-ark.com.