Secure Shell (SSH) keys provide administrators the highest levels of administrative access in financial services organizations. However, these powerful assets are routinely untracked, unmanaged and poorly secured. Unfortunately, this makes SSH keys popular targets for cyber criminals.
“Cyber criminals can leverage compromised SSH keys to gain elevated access to servers and perform nefarious activities, all while remaining undetected,” said Nick Hunter, senior technical manager for Venafi. “In addition, bad actors know that a single SSH key will often be copied across hundreds or thousands of systems.”
Threats that leverage SSH privileged access are especially serious in the financial service sector, where malicious actors can literally access lucrative assets and private information.
Venafi recently conducted a study that evaluated how financial service organizations manage and implement SSH in their environments. With participation from 100 IT security professionals from the finance sector, the study reveals a widespread lack of SSH security controls.
For example, 69% of the respondents admit they do not actively rotate keys, even when an administrator leaves their organization, which can allow the former employees to have ongoing, privileged access to critical systems.
Additional highlights from the study:
- There is no way to determine if keys have been stolen, misused or should not be trusted.
- 85% of the respondents say they do not have a complete and accurate inventory of all SSH keys.
- Unlimited users can generate SSH keys across many systems.
- 61% do not restrict the number of SSH administrators. These administrators tend to be inconsistent about following security controls leaving organizations without any inventory or regular review of SSH trust relationships.
- Attackers can gain elevated privileges.
- Just 29% rotate keys on a quarterly or more frequent basis. 36% say they don’t rotate keys at all or only do so occasionally. This means that attackers who gain access to SSH keys will have ongoing privileged access until keys are rotated.
- No port forwarding controls can mean big trouble for organizations.
- 29% say they do not enforce “no port forwarding” for SSH. Because port forwarding allows users to effectively bypass the firewalls between systems, the lack of these controls can allow a cybercriminal with SSH access to rapidly pivot across network segments.
- SSH keys are not audited.
- Nearly a third (31%) say SSH entitlements are not featured in their Privileged Access Management (PAM) policies and are rarely audited. Without proper auditing and effective SSH security policies, SSH key weaknesses can go undetected, leaving financial services organizations vulnerable to a wide range of cybersecurity attacks.
The financial service sector faces unique and sophisticated cyber security threats. This disregard for SSH security can have profound and devastating consequences on customer privacy and security risk.
Nick concluded: “Cyber criminals can use compromised keys to move throughout a financial services organization, creating additional backdoors and setting up beachheads for their operations.”
Is your financial services organization protecting its SSH keys?