Study: 69 Percent of Financial Services Organizations Do Not Rotate SSH Keys After Employees Leave
December 7, 2017
According to Venafi’s research, even though SSH keys provide the highest levels of administrative access, they are routinely untracked, unmanaged and poorly secured.
SALT LAKE CITY, UT – December 7, 2017: Venafi®, the leading provider of machine identity protection, today announced the results of a study of how financial services organizations manage and implement Secure Shell (SSH). One hundred IT security professionals from the financial services industry participated in the study, which reveals a widespread lack of SSH security controls.
According to Venafi’s research, even though SSH keys provide the highest levels of administrative access, they are routinely untracked, unmanaged and poorly secured. For example, sixty-nine percent of respondents from the financial services industry admit they do not actively rotate keys, even when an administrator leaves their organization. This allows the former employee to have ongoing privileged access to critical and sensitive systems.
“Cyber criminals can leverage compromised SSH keys to gain elevated access to servers and perform nefarious activities, all while remaining undetected,” said Nick Hunter, senior technical manager for Venafi. “In addition, they know that a single SSH key will often be copied across hundreds or thousands of systems. Cybercriminals can use compromised keys to move throughout a financial services organization, creating additional backdoors and setting up beachheads for their operations.”
Key findings of the study include:
Eighty-five percent of respondents say they do not have a complete and accurate inventory of all SSH keys. Without a comprehensive inventory, organizations in the financial services industry cannot determine if keys have been stolen, misused or should not be trusted.
Sixty-one percent of respondents do not restrict the number of SSH administrators, which allows an unlimited number of users the ability to generate SSH keys across large numbers of systems. These administrators tend to use inconsistent security controls that leave organizations without any inventory or regular review of SSH trust relationships.
Just twenty-nine percent of respondents rotate keys on a quarterly or more frequent basis. Thirty-six percent say they don’t rotate keys at all or only do so occasionally. Attackers who gain access to SSH keys will have ongoing privileged access until keys are rotated.
Thirty-nine percent of respondents say they do not enforce “no port forwarding” for SSH. Because port forwarding allows users to effectively bypass the firewalls between systems, a cyber criminal with SSH access can rapidly pivot across network segments.
Nearly a third (thirty-one percent) of respondents say SSH entitlements are not featured in their Privileged Access Management (PAM) policies and are rarely audited. Without proper auditing and effective SSH security policies, SSH key weaknesses can go undetected, leaving financial services organizations vulnerable to a wide range of cybersecurity attacks.
The study was conducted by Dimensional Research earlier this year. It analyzed responses from one hundred IT and security professionals in the financial services sector. Respondents have in-depth knowledge of SSH and are located in the U.S., U.K. and Germany.