The Technology Risk Management Guidelines, published by the Monetary Authority of Singapore, present best practices for financial institutions to establish a technology risk management framework and to strengthen system security.
This white paper will examine the guidelines, highlight particularly significant and challenging requirements found within, and propose cost-effective solution approaches to addressing these.
Examples of available security solutions offered by SSH Communications Security will be presented in each section. Suggestions for further development of the guidelines will also be proposed.
Network World – The Secure Shell (SSH) cryptographic network protocol that’s supported in software for server authentication and machine-to-machine communications is headed for a significant update.
“There will be a new version of SSH,” says Tatu Ylonen, CEO of SSH Communications Security, pointing to the IETF draft document that’s recently been made available for public review. Co-authored with others, including NIST computer scientist Murugiah Souppaya, this third version of SSH has a focus on key management and could be set by early next year.
[ BACKGROUND: Tatu Ylonen, father of SSH, says ‘security is getting worse’ ]
Though Ylonen, whose SSH protocol originated back in 1995, said the new version could take a couple of years to catch on, so he’s pushing for backward compatibility. The last major version, SSH-2, emerged in 2006.
The 58-page IETF draft document, “Managing SSH Keys for Automated Access – Current Recommended Practice,” was published in April and is out for review until October. The document focuses on key management, Ylonen says, in an effort to eliminate now common audit and compliance problems related to SSH.
“There’s no proper tracking of what key exists,” Ylonen says about the situations he sees in many organizations.
The envisioned SSH standard provides guidelines for “discovering, remediating, and continuously managing SSH user keys and other authentication credentials.”
The IETF draft standard describes a process “for discovering who has access to what, bringing an existing IT environment under control with respect to automated access and SSH keys.” It says “the process includes moving authorized keys to protected locations, removing unused keys, associating authorized keys with a business process or application and removing keys for which no valid purpose can be found, rotating existing keys, restricting what can be done with each authorized key, and establishing an approval process for new authorized keys.” It’s all part of what’s supposed to be continuous monitoring and authorized key setup.
Ylonen acknowledges this is not necessarily the practice today and that there’s often an unfortunate state of disorder in SSH key usage that threatens the fundamental security of the assets the protocol is supposed to protect in the enterprise.
His company, SSH Communications Security, next month intends to make available a free key discovery tool that would allow the user to collect SSH key information throughout its IT environment in order to gain an assessment of risk exposure. Called SSH Risk Advisor, this tool is expected to be able to find out where SSH is being used and the SSH keys that may have proliferated.
In work being done for some larger customers, “we’re finding there are more keys than keys to accounts,” Ylonen notes. SSH Communications Security is observing instances in its customer base where mismanagement of keys has spawned literally hundreds of thousands of SSH keys, but it’s unclear how many are really supposed to be in use. Cleaning up the problem and devising new controls can be a mammoth — and expensive — task, he points out. SSH Communications Security itself is focusing increased product development on key management, for example coming up with SSH Universal Key Manager.
But Ylonen says the free SSH Risk Assessor tool is intended to make it possible for enterprises using SSH keys for secure access to get a picture of what might be out-of-control SSH key proliferation. Cleaning up the mess is another matter.
Everyone has that little voice inside them that wonders in the middle of the night whether or not the front door is locked. Do you get up to check or stay in bed as the worries seep into bad dreams?
When it comes to SSH keys, however, most companies don’t even realize that up to 10,000 unlocked back doors may be open in the middle of the night, but that is exactly the case, at least according to SSH Communications Security. SSH keys, otherwise known as secure shell keys, are a cryptographic network protocol that automates commands between two or more networked computers. When it comes to large banks or logistic companies with 20,000 to 100,000 servers, there can literally be hundreds of thousands of keys. One of the company’s clients has 10,000 hosts with over a million keys, 10 percent of which provided the highest possible administrative access. More...
SSH Communications Security whose headquarters is in Helsinki, Finland, launches its new product “CryptoAuditor” in Singapore on 24 September 2012. The company has more than 3,000 customers worldwide including service providers and financial institutions and Singapore is the first South-east Asian country to launch the company’s “CryptoAuditor”, a product which is able to audit and review encrypted data and monitor privileged users activities even in encrypted environments. The article noted Mr. Tommi’s comments that CryptoAuditor is able to provide a fully transparent auditing solution and strong data-in-transit security that requires no changes to existing network architecture. It also noted Mr. Ricky’s comments that one of the benefits of the CryptoAuditor is that it can be easily managed through a central management system that has a audit trail storage where activities can be replayed or monitored in real time and therefore reduces the risk of data history being tampered by privileged or external users.
LAS VEGAS, NV– (Black Hat 2012 Booth #536) – July 25, 2012 – SSH Communications Security, known the world over as the inventor of the SSH protocol, today announced the launch of its CryptoAuditor™ solution at the Black Hat USA 2012 conference. The new offering helps prevent data loss across encrypted secure shell, RDP and SFTP traffic with inline, real-time and transparent audit capabilities for financial service providers, retailers and other enterprises transmitting sensitive information. CryptoAuditor is the second module released this year as part of the company’s Information Assurance Platform. More..
Data-Terminator constantly brings the best in class solution to our customer via the best available platform and this year we successfully showcase our Security and Auditing Tools that is non-intrusive to your environment.
This includes leading edge solution from Tectia/SSH, Skybox, Accesslayer, Intellinx and More.
Whether you use Tectia SSH, OpenSSH or both, the Universal SSH Key Manager delivers a fully interoperable and scalable solution. It allows you to save time and money by eliminating the complex, manual work required to manage enterprise SSH environments, by reducing the risk of unauthorized access from both internal and external actors, and by improving visibility and compliance. More…
Data Terminator is pleased to be once again participating in Governmentware 2011 which will be held from 27 to 29 September 2011 at the Suntec International Convention & Exhibition Centre. Our booths: C21 are located at Hall 403, Suntec Convention Centre.
Data Terminator will be hosting its annual security seminar on 8 June 2011 this year at Suntec City Convention Centre.
Come join us at this seminar to find out about: