SSH key mismanagement potentially worse in Asia

By -

SSH key mismanagement potentially worse in Asia, says founder

Summary: Secure shell key management could be a bigger mess in Asia because cultural barriers in the workplace can lead to less communication, according to CEO and founder of SSH Communications Security.
Unmanaged Secure Shell (SSH) keys can leave a door open for authorized access by both malicious insiders and external threats, and these can be left undiscovered for years if ever.
Over the past decade, very little attention has been paid over to the worsening situation because it is technical and deep within systems, said Tatu Ylonen, CEO and founder of SSH Communications Security, in an interview.
Ylonen was also the author behind the Secure Shell protocol back in 1995, which is now used widely in the industry for business critical functions, automating administrative scripts, day to day file transfer, server authentication and machine-to-machine (M2M) communications.

The problem is more serious that what many realize because the bulk of SSH authentication processes are automated and left unmonitored. (credit: SSH)
The mess has come about because most organizations do not have a system of tracking what keys have been made and for what purpose. This leaves an untidy accumulation of keys that continue to provide access even after the user has left the organization.
"The keys can be used for hiding backdoors; and that will create a danger. Such keys can remain undiscovered for years, and even after being discovered, it may be difficult for the organisation to determine whether the key was originally created for a business purpose or for some malicious activity--if there has been no management or control over the keys," Ylonen said.
While the problem is a ticking time bomb globally, it's potentially worse in Asia, Ylonnen pointed out. That's because cultural barriers in the region can make communications to top level decision makers more difficult especially since it is a "low level technical problem".
A bank was recently found to have several million keys, with 1.5 million unauthorized ones created in the last year and a half alone, said Ylonen, describing the extent of some cases.
The good news is that companies have been starting to wake up especially in the past six months partly due to better understanding of the security problem, said Ylonen. This has partly been helped with discussions at conferences raising awareness over the issue and regulators taking the lead, he explained.

Establishing policies is first step to better security


Tatu Ylonen, CEO and founder of SSH Communications Security.

To remedy the SSH key management problem, organizations should set up policies as a start, said the protocol's founder. Specific steps can include moving keys to protected locations, rotating keys on a regular basis, and removing keys that no longer service a valid purpose. Toolsare available to help weed out unnecessary keys in bulk, by setting parameters such as inactivity in the past six months, Ylonen pointed out.
The gravity of the situation has also been reflected in the new standards for the payment cards industry, PCI 3.0, released earlier this month which takes effect on January 1, 2014. They included more guidance on the industry's management of SSH keys, with regard to authentication and remote access to any network segment that processes or stores payment cards.
"I am happy with the rules themselves. The rules are clear--the organisations need to control the access to systems," said Ylonen. This supported his view that encryption alone was not enough if there was no control over who could gain access to files or the encryption keys, he added.
However, Ylonen noted there was still scope for the guidance to be more explicit to prompt auditors to ask the right questions from their customers. "There are many cases where the financial institution's contact point for the PCI audit might not know to what extent they are using SSH and SSH keys. We have found that in many organizations even the head of Unix engineering does not know how much SSH-based authentication is in use, and organizations have been stunned when discovering the extent of that usage.

Comments

Post a Comment

Popular Posts

Hacker steals data of millions of Bulgarians, emails it to local media

By -
Image
  Source of the data breach appears to be the country's National Revenue Agency A mysterious hacker has stolen the personal details of millions of Bulgarians and has emailed download links to the stolen data to local news publications. The data's origin is believed to be the country's National Revenue Agency (NRA), a department of the Bulgarian Ministry of Finance. In a  message posted on its website  on Monday, the NRA said it was working with the Ministry of the Interior and the State Agency for National Security (SANS) to investigate the hack. "We are currently verifying whether the data is real," said the NRA. Hours after this article's publication, the Bulgarian Ministry of the Interior  confirmed the hack . HACKER STOLE 110 DATABASES, LEAKED 57 According to reports from local media [ 1 ,  2 ,  3 ,  4 ,  5 ], who received part of the data, the hacker said they stole the personal details of over five million Bulgarians, of the country's total ...
Read more

​Linux totally dominates supercomputers

By -
Image
It finally happened. Today, all 500 of the world's top 500 supercomputers are running Linux. Linux rules supercomputing. This day has been coming since 1998, when Linux first appeared on the TOP500 Supercomputer list . Today it finally happened:  All 500 of the world's fastest supercomputers are running Linux . The last two non-Linux systems, a pair of Chinese IBM POWER computers running AIX, dropped off the  November 2017 TOP500 Supercomputer list . Overall, China now leads the supercomputing race with 202 computers to the US' 144. China also leads the US in aggregate performance. China's supercomputers represent 35.4 percent of the Top500's flops, while the US trails with 29.6 percent. With an anti-science regime in charge of the government, America will only continue to see its technological lead decline. When the  first Top500 supercomputer list was compiled in June 1993 , Linux was barely more than a toy. It hadn't even adopted Tux as its masc...
Read more

Microsoft tries to stem its self-made collaboration-tool confusion

By -
Image
Microsoft is using this week's Ignite conference to try to help clarify its collaboration-tool strategy. Here's how SharePoint, Teams and Yammer figure in the mix. Choice is good. But too much choice, especially when it comes to collaboration tools, has been a problem for Microsoft. This isn't news to customers, partners or Microsoft execs themselves. But at the company's Ignite IT Pro conference in Orlando this week, Microsoft execs took a step to try to clarify the company's strategy and messaging in this area. Microsoft Office 365 Marketing chief Ron Markezich kicked off the conference this week with a slide entitled "Microsoft 365 Teamwork: Where to Start a Conversation." That slide attempts to do what  Microsoft initially attempted with a 60-plus-page whitepaper : Clarify which collaboration tools customers should use when. The slide, which features SharePoint -- and its files, sites and content storage at the center -- is broken down into t...
Read more