Secure Shell (SSH) Data Security
The Ponemon Institute and Forrester have both published studies that have raised a lot of attention, and questioned the security of SSH deployments, and both focus on the implementation practices and procedures. The ugly truth is that this vital tool is often little considered in the security plans of many enterprises.
The focus of both of these studies is on SSH key management. This can certainly be a very important topic, especially with a standard/default SSH implementation: if you need to use SSH user-keys for authentication it becomes enabled for all accounts that have access to the system. Continue reading
Over the last month, we have seen scurity researches manage to “drive” a Jeep Cherokee, hack into a Tesla Model S, and even control windsheild wipers — all from sitting in their cozy chairs behind a computer.
Could someone half a world away hack into, and take control of your car? Will your car suddenly start driving down the road by itself or — worse — develop a mind of its own as you’re hurtling down the highway at 65 mph? Nervous yet?
Thank you for watching the second webinar installment: “Oh SSH..IT, Now What?”
We hope that you found the presentation educational, and look forward to your attendance and participation next week.
Control Your SSH..IT
Thursday October 16th, 2014 | 10am PDT/1pm EDT
- The “what” of SSH; what SSH services an account is allowed to use, and what they can do once granted access
- Adding privilege management as an incorporated control measure
You may also be interested in: Taming the Beast – SSH for Security and Compliance
FoxT Access Management & Governance solutions complement your existing technologies by adding granular control and enforcement of authentication and authorization policies for both privileged and end users. www.foxt.com/boks
Thank you for joining us for the first installment of our 3-part webinar series on SSH. Below are your questions answered.
Re: key management. If keys and logging is configured correctly, ssh/pka is multi-factor authentication which is invariably “better” than single factor authentication. It sounds like foxit’s stance is pointed more towards single factor auth to privileged accounts. Is that accurate and, if so, how is that justified?
FoxT absolutely does not recommend passwords, or another single-factor authentication, as the preferred method of authentication. A key aspect that we were attempting to draw out is that in locally configured and controlled SSH deployments, and with many products that offer SSH access control, the decisions on how SSH is controlled are globally applied. FoxT believes, and the BoKS ServerControl product provides, a much more granular solution to SSH access control than what was discussed in the initial presentation, which was intended to draw out the deficiencies in many SSH implementations. Continue reading