It’s no secret that privileged accounts are exploited in the vast majority of advanced cyber attacks, and these advanced attacks are becoming more and more common. In fact, according to a survey by IDC*, almost 80% of Chief Information Security Officers (CISOs) have had to notify their executive teams of a significant breach.
Yet, as organizations work to better secure their organizations and reduce the privileged account attack surface, Secure Shell (SSH) keys – which provide privileged and often root access to Unix and Linux systems – are often overlooked. According to a new IDC Market Spotlight, “Minimizing Cybersecurity Risk with Vigilant SSH Key Management,” organizations that leave their SSH keys unsecured and unmanaged may inadvertently be providing attackers with complete and undetected access to sensitive data and critical assets.
While many IT security teams presume that the SSH protocol alone is enough to secure access to their sensitive systems, this rationale can create significant risks. As the IDC Market Spotlight points out, just like privileged passwords, “SSH keys can either serve to protect important data or become virtual skeleton keys unlocking the entirety of an organization’s assets.” The only way to ensure the former is to properly secure and manage these privileged credentials.
According to IDC, there are four ways in which organizations often mismanage SSH keys, potentially opening up the organization to a serious breach:
- Lack of visibility into SSH keys. SSH keys are often only known to those who create and use them. As a result, many members of the security and risk management teams may be entirely unaware of the SSH key-based privileged access that exists in their environment.
- Frequent key sharing between users and systems. Because most SSH key users independently manage their keys, without the help of any tools, SSH keys often become replicated across systems and shared among teams. As a result, it can be incredibly difficult for security and audit teams to clearly track who did what and when.
- Manual (if any) key rotation processes. Though most IT administrators understand the importance of credential rotation and revocation, when done manually, this process can be difficult, time-consuming and operationally high risk. If individual keys were accidentally overlooked, the consequences could range from inconvenient user lockouts to major system outages. Yet, by maintaining static SSH keys, an attacker could use a compromised key to gain persistent privileged access to sensitive enterprise resources.
- Embedding keys into applications – and forgetting about them. SSH keys are often embedded by developers into applications and scripts to automate authentication. While this helps streamline processes, these keys are often either forgotten about or intentionally left static to avoid the risk of a system outage, should a key be missed in the manual rotation process. Yet, if compromised, an attacker could use these credentials to access critical systems and laterally move through the environment.
To effectively manage the risks associated with SSH keys, IDC recommends that organizations consider automated SSH key management solutions. A centralized solution can help organizations locate existing SSH keys to identify unexpected SSH connections, secure private SSH keys with access controls and strong authentication, rotate key pairs throughout the environment, and audit the use of SSH keys to more easily determine who did what with which key. By strengthening security in an automated way, organizations can better protect their sensitive assets while avoiding the operational risks associated with manual key rotation. In addition, the detailed audit trail provided by SSH key management solutions can help organizations comply with regulatory standards, such as PCI DSS 3.0, and accelerate incident investigation and response times.
Download to the IDC Market Spotlight to learn more about how to minimize SSH key risks, and visit the CyberArk SSH Key Manager webpage to learn how CyberArk solutions can help you secure SSH keys, rotate key pairs and better protect your sensitive assets.
*Source: The State of the “C” in CISO, doc #254283, February 2015
