BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Infosec 2011 Survey Reveals Root Password Bad Practice

Posted April 21, 2011    Peter McCalister

At Infosec 2011 in London this week (Europe’s largest information security trade show), a survey by BeyondTrust of over 50 first day attendees revealed that root password bad practice continues to be unchecked in many organizations.

Of those polled, over 58% said they would be able to steal information from a mission critical server if they wanted to.  35% of respondents revealed that the root password would be easily available because it was written on a post-it note, or white board in easy view of other employees.  A further 29% said that they could obtain the root password simply by asking for it, even if they didn’t have just cause for having it.

This, says Geoff Haggart, president of BeyondTrust International, shows the assumption that once someone has authorized access, that they won’t misuse it. He continues: “Bad practice in the management of root password is still very much evidenced today, in spite of increasing data breaches caused by insiders (employees and third party contractors).  However, as audit and compliance continue to focus on high risk assets, the need for better management of privileged access (who gets access to what and when) becomes paramount.”

 

The survey responses in full were:

If you wanted to steal sensitive information from a mission-critical server in the company, do you think you could?

  • Yes? 58%
  • Maybe? 25%
  • No? 17%

 

How easy would it be for you to find out the root password to a mission critical server without having just cause for having it?

  • Very easy (its written on a post-it or white board in easy view) – 36%
  • Quite easy (I could ask someone who knows and they would give it to me on trust) 29%
  • Not so easy (I’d have to bribe the IT Admin) 35%

 

What would you be willing to do to get your hands on £20?

  • Climb Everest in a tutu? 25%
  • Swim Naked across the Channel? 12.5%
  • Lose your job and leave the country? 21%
  • Leak information to a competitor? 11%
  • Steal data from a mission critical server? 30%

Leave a Reply

Additional articles

PBPS-screenshot-blog aug2014

Failing the Security Basics: Backoff Point-of-Sale Malware

Posted August 22, 2014    Marc Maiffret

At the beginning of this month, US-CERT issued a security alert relating to a string of breaches that had been targeting Point of Sale (POS) systems. The alert details that attackers were leveraging brute forcing tools to target common remote desktop applications such as Microsoft’s Remote Desktop, Apple Remote Desktop, Splashtop and LogMeIn among others….

Tags:
, , , , , ,

Troubleshooting Windows Privilege Management Rules with Policy Monitor

Posted August 21, 2014    Jason Silva

When defining and testing PowerBroker for Windows rules for production or pilots, customers sometimes tell us, “I don’t think this policy / program is working.” This is usually a case of the policy not properly triggering because of the way the rule was created. A unique feature of PowerBroker for Windows compared to other solutions is a client-side…

Tags:
, , ,
darren-mar-elia

BeyondTrust Webcast: Darren Mar-Elia’s 4 Active Directory Change Scenarios to Track

Posted August 20, 2014    Chris Burd

In our latest webcast, we joined Darren Mar-Elia, CTO at SDM Software, to discuss best practices for Active Directory (AD) change management. Here are some key takeaways from the presentation, followed by a link to a full-length video of the presentation. Mar-Elia kicks things off with a critical insight: that the best AD change management…

Tags:
, , , , , , ,