Free Newsletter
Register for our Free Newsletters
Newsletter
Zones
Access Control
LeftNav
Alarms
LeftNav
Biometrics
LeftNav
Detection
LeftNav
Deutsche Zone (German Zone)
LeftNav
Education, Training and Professional Services
LeftNav
Government Programmes
LeftNav
Guarding, Equipment and Enforcement
LeftNav
Industrial Computing Security
LeftNav
IT Security
LeftNav
Physical Security
LeftNav
Surveillance
LeftNav
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
 
News

Lax approach to power passwords locks out organisation's data

CyberArk Software : 17 July, 2008  (Technical Article)
San Francisco IT employee locks down regional data with secure password change
Cyber-Ark, the privileged identity management specialists, says that the ongoing FiberWAN network lockout situation in San Francisco - where a network administrator has changed system passwords and is refusing to hand them over to administrators - could have been avoided if managers had operated a high-security approach to master passwords.

'Administration passwords are always being changed for security reasons, such as when IT staff leaves and also for general security reasons. The main problem with admin passwords is that a number of people need access to them at any given time,' said Adam Bosnian, VP Marketing with Cyber-Ark.

'If the operators of the FiberWAN network - which gives San Francisco city administrators access to payroll, law enforcement data and prison bookings, amongst other things - had a top-level master password, which was stored securely, then the current lock-out situation would have been side-stepped,' he added.

According to Bosnian, the San Francisco FiberWAN chief executive could have stored the top-level master password in a digital vault, meaning that no-one need actually know what the password was, but it could be accessed electronically by relevant senior staff, if the need ever arose.

'Audit logging and alerting technologies documented in the Digital Vault would prevent the master password from being accessed except in absolute emergencies, such as the current situation in San Francisco,' he explained.

Bosnian's comments come in the wake of newswire reports from the US which alleges that a rogue employee - 43-year-old Terry Childs - locked the city's FiberWAN network with his own passwords and has refused to give police or his colleagues the details.

'Childs is reported to have been arrested over the weekend, and is in jail pending a court appearance, but the bottom line is that, whilst the network is functioning normally, IT staff has not got supervisory access, and all due to the actions of a single, rogue employee,' he said.
Bookmark and Share
 
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
 
   © 2012 ProSecurityZone.com
Netgains Logo