BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Administrative Privileges are Behind Many, but not all Breaches

Posted January 18, 2011    Peter McCalister

Ok – so even we admit not EVERY security breach is related to administrative privileges. We saw how horrible the passwords were of Gawker users; we know hackers exist too and there is a remaining 10% of critical Microsoft vulnerabilities that can’t be mitigated by removing admin rights. A recent reporton Virgin Media’s email recycling, which would allow a new email recipient to “retrieve a forgotten password” of the email’s previous owner could not be prevented with any measure related to administrate privileges.

But lets take a look at the last week:

  • IBM’s DeveloperWorks site recently had this replacing certain pages after hackers leveraged a vulnerability to gain access. Since it requires admin access to upload new web pages, it’s reasonable to suggest they used a vulnerability to gain administrative privileges. Could IBM have prevented it? The hacker-posted website seems to indicate as much.
  • Vodafone just suffered a breach somehow related to password sharing. You may think this is a password issue, but since the breach involved hundreds of customer accounts, which passwords do you think could grant access to hundreds of accounts? Yup – you got it – an admin’s password. Few other people have access to entire databases.
  • This one is particularly interesting, because it highlights that “Printers and copiers are often overlooked as a potential source of a data security breach but they need to be handled just as carefully as a PC.” Some printers keep copies of everything ever printed and employees tinker with their printer settings almost as often as their desktops. How many help desk inquiries do you get regarding printers?

Leave a Reply

Additional articles

pbps-blog2

10 Ways to Ensure Your Privileged Password Management Strategy Will Succeed

Posted April 27, 2015    Scott Lang

Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organisation. But if passwords are such a no-brainer, why do so many data breaches tie back to poor password management?

Tags:
, , , , , , , ,
beyond-trust

PowerBroker for Windows – Most Innovative IAM Solution by Cyber Defense Magazine

Posted April 21, 2015    Scott Lang

PowerBroker for Windows has been selected as a winner by the 2015 Cyber Defense Magazine Awards Program in the category of “Most Innovative Identity and Access Management Solution”.

Tags:
, , ,
pbps-customer-campaign-image

Are you changing your passwords as often as the weather changes?

Posted April 20, 2015    Scott Lang

There is one thing that should change more frequently than the weather: Your privileged passwords. Why? If you’re like more than 25% of companies out there, then your current IT environment contains unmanaged accounts putting you at risk of data breaches and compliance violations, and you don’t have a process to control those accounts.

Tags:
, , , ,