According to new research by Venafi, even though SSH keys provide the highest levels of administrative access, they are routinely untracked, unmanaged and poorly secured.
For example, 69 percent of respondents from the financial services industry admit they do not actively rotate keys, even when an administrator leaves their organization. The survey said that this allows the former employee to have ongoing privileged access to critical and sensitive systems.
“Cybercriminals can leverage compromised SSH keys to gain elevated access to servers and perform nefarious activities, all while remaining undetected,” said Nick Hunter, senior technical manager for Venafi. “In addition, they know that a single SSH key will often be copied across hundreds or thousands of systems. Cybercriminals can use compromised keys to move throughout a financial services organization, creating additional backdoors and setting up beachheads for their operations.”
Key findings of the study include:
- Eighty-five percent of respondents say they do not have a complete and accurate inventory of all SSH keys. Without a comprehensive inventory, organizations in the financial services industry cannot determine if keys have been stolen, misused or should not be trusted.
- Sixty-one percent of respondents do not restrict the number of SSH administrators, which allows an unlimited number of users the ability to generate SSH keys across large numbers of systems. These administrators tend to use inconsistent security controls that leave organizations without any inventory or regular review of SSH trust relationships.
- Just twenty-nine percent of respondents rotate keys on a quarterly or more frequent basis. Thirty-six percent say they don’t rotate keys at all or only do so occasionally. Attackers who gain access to SSH keys will have ongoing privileged access until keys are rotated.
- Thirty-nine percent of respondents say they do not enforce “no port forwarding” for SSH. Because port forwarding allows users to effectively bypass the firewalls between systems, a cybercriminal with SSH access can rapidly pivot across network segments.
- Nearly a third (thirty-one percent) of respondents say SSH entitlements are not featured in their Privileged Access Management (PAM) policies and are rarely audited. Without proper auditing and effective SSH security policies, SSH key weaknesses can go undetected, leaving financial services organizations vulnerable to a wide range of cybersecurity attacks.
The study was conducted by Dimensional Research earlier this year. It analyzed responses from one hundred IT and security professionals in the financial services sector. Respondents have in-depth knowledge of SSH and are located in the U.S., U.K. and Germany.
