Lies, damned lies and statistics

This article is brought to you by Retail Technology Review: Lies, damned lies and statistics.

I would never make disparaging comments about my wife, especially since shes smarter than me and has a lot more letters after her name than I do but shes driving me crazy with the weather. Ever since she discovered the weather forecast websites she browses to about ten of them and tells me what theyre predicting about the weather. And usually while theyre predicting sunshine its usually pouring rain and shes asking me why theyve got it wrong and what does it mean that theres a 70% chance of something happening! Shes the one with the Masters so why is she asking me!!!

In fact Im bombarded by stats every day. Ive just discovered that 25% of drivers using Sat-Nav have driven down a one way street. Bottom line is that were bombarded with stats every day and we simply take them for granted. We believe them. Of course there are a few folks out there who have started to fight back at the statmongerers demanding to know where the stats come from. I dont have any stats about how many are actually doing this but probably 99% of us have something better to do!

Over the past couple of years there has been an endless stream of stats, including from yours truly, about the insider threat and yet the vast majority of IT Security officers appear to be oblivious to them.  So heres a stat that I guarantee will not be disputed. Right now there is a 100% chance that some organization is the victim of either malicious activity by a member of their IT staff or the stupidity of one of this elite group.

Forget the stats and just look at the news. In the past year weve had instances in San Francisco, San Diego, Paris, Lichtenstein, and a host of other instances of IT staff abusing their privileges.  In these and many other cases the problem is ultimately due to a lack of control and proper process within the organisation. According the Burton Group Privileged accounts can bypass most internal controls to access confidential information and cause denial of service attacks either by deleting data or rendering applications inoperable. In many cases, unauthorised users can use privileged accounts to cover their tracks by destroying audit data.

In San Diego an IT specialist had deliberately deleted patient and allied data from his former employer's computer systems. He now has five years to reflect on his actions but the damage is done. In San Francisco a computer network administrator for the Department of Technology, tampered with the network, which contains the citys sensitive data, and created an administrative password that gave him exclusive administrative access. Apart from the embarrassing publicity and inconvenience, the millions it will reportedly cost to fix should be enough of a statistic to make you pause for thought! And in both cases and so many others easily and inexpensively avoided!!

The challenge is to ensure proper use of these accounts. The challenge as clearly stated by Gartner is that Shared super user accounts, which are generally system-defined in operating systems, databases, network devices and so on, pose significant risks when the passwords are routinely shared by multiple users. So, too, do shared firecall accounts, which are used to deal with critical problems outside normal working hours, when passwords are managed using fragile manual processes.

Forrester state in a recent report that to manage shared account passwords in a controlled and accountable way, an organization must first establish an appropriate process. Spreadsheets, sealed envelopes, printouts, sticky notes, and other old-fashioned ways of managing access and passwords on sensitive systems dont scale, dont provide sufficient levels of security, and dont provide enough auditing details that todays auditors require.

Thanks to the wonderful work done by analysts over the past couple of years, and the plethora of regulations that have become part of our lives, your internal IT practices are increasingly coming under the scrutiny of auditors. Whatever sector you find yourself in, the likelihood is that you will be required to submit to a compliancy and regulatory audit.

An audit will use your policies and test their effectiveness. Improper policies will result in non-compliance, and certainly not adhering to the policy will result in non-compliance. Responsiveness to auditors requests demonstrates effective controls, so it is absolutely essential that an organisation has the processes in place to ensure timely responsiveness. Delaying or not responding to audit requests will result in a failure.

So what is the auditor going to be looking for? Well the following are some pointers based on past experience that might help:

Firstly make sure that you have an automated reporting system. Writing changes on paper are not going to be well received.

Categorise your systems based on their criticality and the sensitivity of the data that may be stored. Ensure that you are able to prove that your policies allow for

         Password automatically changed on a regular basis corresponding to a set interval, for instance every 60 days.

         Password can be automatically changed when requested

         Password can be changed automatically after a short amount of time after checkout, e.g. 30 minutes.

         Passwords are changed automatically between each usage and that if required only one person at a time can have access

         Show that you are able to verify the passwords on a regular basis to ensure that no unauthorized change to a password has occurred

One statistic that I can be sure about is that there is a 100% chance that some organisation somewhere is currently suffering from improper use of their systems due to the misuse of privileged accounts and sooner rather than later yet another organization will make the headlines because they didnt take the necessary precautions to protect themselves. Its always raining somewhere.