Problem: Privileged Passwords

Thousands of IT assets:

Who has the keys to the kingdom?

• Thousands of workstations:
  • Dynamic location, IPs
  • May be on/off
  • May be lost/stolen
  • May be behind firewalls
• Hundreds of servers.
• Hundreds of applications.
• Multiple platforms.

• Every IT asset has sensitive passwords:
  • Administrator passwords:
    Used to manage each system.
  • Service passwords:
    Provide security context to service programs.
  • Application:
    Allows one application to connect to another.
• Do these passwords ever change?
• Who knows these passwords? (ex-staff?)
• Is there accountability for administrative actions?