Financial services organizations fail to properly secure SSH keys

Secure Shell (SSH) provides a secure channel for communication over unsecured networks and is therefore a popular technology in the financial services sector.

But a new study for machine identity protection company Venafi shows that even though SSH keys provide the highest levels of administrative access, they are routinely untracked, unmanaged and poorly secured.

According to the findings 69 percent of respondents from the financial services industry admit they don't actively rotate keys, even when an administrator leaves their organization. This allows the former employee the potential for ongoing privileged access to critical and sensitive systems.

"Cyber criminals can leverage compromised SSH keys to gain elevated access to servers and perform nefarious activities, all while remaining undetected," says Nick Hunter, senior technical manager for Venafi. "In addition, they know that a single SSH key will often be copied across hundreds or thousands of systems. Cyber criminals can use compromised keys to move throughout a financial services organization, creating additional backdoors and setting up beachheads for their operations."

Among other findings are that 85 percent of respondents say they don't have a complete and accurate inventory of all SSH keys, making it hard to determine if keys have been stolen, misused or should not be trusted.

The number of SSH administrators is not restricted by 61 percent, which allows an unlimited number of users the ability to generate SSH keys across large numbers of systems. These administrators tend to use inconsistent security controls that leave organizations without any inventory or regular review of SSH trust relationships. In addition 31 percent of respondents say SSH entitlements are not featured in their Privileged Access Management (PAM) policies and are rarely audited.

Only 29 percent of respondents rotate keys on a quarterly or more frequent basis, and 36 percent say they don't rotate keys at all or only do so occasionally. In addition 39 percent say they don't enforce 'no port forwarding' for SSH. Because port forwarding allows users to effectively bypass the firewalls between systems, this omission allows a cyber criminal with SSH access to rapidly pivot across network segments.

You can discover more about the findings on the Venafi blog.

Photo Credit: Number1411/Shutterstock