BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Infosec 2011 Survey Reveals Root Password Bad Practice

Post by Peter McCalister April 21, 2011

At Infosec 2011 in London this week (Europe’s largest information security trade show), a survey by BeyondTrust of over 50 first day attendees revealed that root password bad practice continues to be unchecked in many organizations.

Of those polled, over 58% said they would be able to steal information from a mission critical server if they wanted to.  35% of respondents revealed that the root password would be easily available because it was written on a post-it note, or white board in easy view of other employees.  A further 29% said that they could obtain the root password simply by asking for it, even if they didn’t have just cause for having it.

This, says Geoff Haggart, president of BeyondTrust International, shows the assumption that once someone has authorized access, that they won’t misuse it. He continues: “Bad practice in the management of root password is still very much evidenced today, in spite of increasing data breaches caused by insiders (employees and third party contractors).  However, as audit and compliance continue to focus on high risk assets, the need for better management of privileged access (who gets access to what and when) becomes paramount.”

 

The survey responses in full were:

If you wanted to steal sensitive information from a mission-critical server in the company, do you think you could?

  • Yes? 58%
  • Maybe? 25%
  • No? 17%

 

How easy would it be for you to find out the root password to a mission critical server without having just cause for having it?

  • Very easy (its written on a post-it or white board in easy view) – 36%
  • Quite easy (I could ask someone who knows and they would give it to me on trust) 29%
  • Not so easy (I’d have to bribe the IT Admin) 35%

 

What would you be willing to do to get your hands on £20?

  • Climb Everest in a tutu? 25%
  • Swim Naked across the Channel? 12.5%
  • Lose your job and leave the country? 21%
  • Leak information to a competitor? 11%
  • Steal data from a mission critical server? 30%

Leave a Reply

Additional articles

BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,
insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,