Page 86 - Cyber Warnings

For many others, the point would be to extract information, a breach committed to gain
competitive intelligence. In such cases, privacy and regulatory issues would be of paramount
concern.

Steps to Security

Essentially, this is an administrative problem. No quick fix is available. Enterprise operations
totally depend on automation made possible by SSH keys. Enterprises must establish proper
management of automated access just as they manage passwords. They must also sort out the
legacy mess.

The sooner this is accomplished, the sooner the enterprise can rest easier. The first step is to
establish a controlled provisioning process. Unused and policy-violating SSH keys must be
destroyed, and application teams need to justify with sign-off on any remaining keys that provide
access to the information systems they are responsible for managing.

Tools are available today to assist with this process, as the problem is typically too large to
tackle manually.

As a final step, carefully review SSH key-based access into backup systems and disaster
recovery data centers to close the loop. Fortune 500s and other enterprises that take these
steps have taken back control of a situation that could otherwise devastate them and their
shareholders.

About the Author
Tatu Ylonen is the founder and SSH Fellow of SSH Communications
Security and the
creator of the SSH protocol and the founder of SSH Communications
Security. He is an experienced entrepreneur, manager and engineer. He still
keeps up to date with technology and loves the technical side and inventing
new technology.

He participates in product architecture design and occasionally writes code when he has time or
when he thinks that’s where he can bring the most value.

His primary current interests relate to broader cybersecurity priorities and how to design
systems to be more secure. He understands both the big picture and the deep technical issues.
He also wants to solve the massive gap in identity and access management in relation to SSH
key based credentials.

Tatu can be reached online at @tjssh and at the company website: https://www.ssh.com/.

86 Cyber Warnings E-Magazine – April 2017 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide