Privileged Password Management
Many organizations have insecure processes for managing privileged passwords -- local IDs and passwords embedded in servers, workstations and applications with elevated privileges. Inappropriate disclosure of these passwords would lead to serious security compromise:
- Hundreds or thousands of workstations and servers often share the same administrator credentials. If one device is compromised, all are compromised.
- With thousands of workstations and servers, it is difficult or impossible to ever change these passwords. Privileged passwords remain the same for months or years, creating an extended window of opportunity for an attacker to crack them.
- If privileged passwords are rarely changed, as IT staff turn over, ex-staff retain access to sensitive systems.
Hitachi ID Privileged Password Manager is designed to address the challenges posed by management of thousands of privileged passwords:
- Each privileged password is changed regularly -- usually once per day.
- Privileged passwords are set to random strings. No two are ever alike and no single privileged account gets the same password twice.
- IT staff are authenticated, personally, before gaining access to administrator accounts such as Unix/root or Windows/Administrator.
- Programs that require access to sensitive passwords are authenticated, using a one-time-password and their IP subnet, before being granted access to a password.
- Access control rules and a workflow authorization engine determine whether a given IT user or program may access a given password.
- Audit logs track password disclosure, creating accountability.