Early in the life of the internet it became clear that encryption would be necessary to conduct e-commerce or perform any meaningful transactions online. This is how the OpenSSL Project began. It was founded to create a robust, open source toolkit using strong, general-purpose cryptography. Today, two-thirds of all web servers use OpenSSL.
This software has worked well for almost 20 years. But its success has outstripped its resources – a budget of less than $1m per year, one full-time employee, and a handful of volunteers. The effort has been admirable, but so little supervision can lead to significant security issues. The Heartbleed OpenSSL vulnerability woke everyone up to the risks that open source software can pose if the management, development and design aren’t up to par.
The threat such vulnerabilities could pose to security is driven home by the four hackers who succeeded in exploiting the Heartbleed vulnerability to steal private Secure Shell (SSH) security keys. This is why an OpenSSL vulnerability can be so dangerous.
The Danger of Key Mismanagement
Secure Shell keys are text files that encrypt connections and access the organization’s network. Associated with each key is an identity: either a person or machine that grants access to information assets and performs specific tasks, such as transferring a file or dropping a database, depending on the assigned authorizations. In the case of Secure Shell keys, those text files provide access to some of the most critical information within an organization.
Proper key management is a security necessity. Organizations need a holistic security strategy that takes these risks into account.
M2M Reveals the Need for Centralized IAM Controls
Identity and access management (IAM) control becomes increasingly important with the spike in popularity in machine-to-machine (M2M) activity. IAM solutions are part of an overall security strategy that helps organizations control access to cloud infrastructure, applications, servers and both structured and unstructured data. These solutions manage the identities assigned to interactive human users well, but not so the larger number of identities assigned to the automated processes that drive much of the computing in large-scale data centers. As non-human identities continue to grow, IAM implementations are not addressing the majority of identities performing the bulk of operations.
M2M data transfers are convenient and create efficiencies, but they require a secure encrypted channel. That is why most of the identities that enable M2M processes use Secure Shell for authentication and authorization.
However, holes exist in IAM governance of identities that use Secure Shell. Instead of a centralized provisioning procedure, application developers, application owners and process owners may all have identity creation and assignation privileges. This often leads to a lack of proper control and oversight over creation of identities and their authorizations.
Without central management and visibility, enterprises cannot be sure how many Secure Shell identities have been created, what these identities are authorized to perform and which authorizations are in fact no longer needed.
Open Source’s Teachable Moment
Vulnerabilities in open source software have created an opportunity for organizations to
reconsider how they use and manage open source technologies. The point here is not that open source is bad. Rather, it is a call for technology executives to take another look at the crucial but frequently forgotten infrastructure that undergirds their businesses, especially something as omnipresent and critical as encryption protocols.
Websites have relied on the encryption that OpenSSL provides since 1998, and in general it has proven reliable and safe. Any software can have vulnerabilities; this particular software’s vulnerabilities are critical to security. The fact that hackers can use such vulnerabilities to steal Secure Shell keys creates a sense of urgency to re-examine key management within the organization.
Organizations that take a proactive approach to proper key management will follow best practices for using OpenSSL as well as Secure Shell keys, including visibility into key use and creation, careful attention to IAM controls and centralized provisioning. Failure to do so creates a vulnerability that extends across an organization’s entire network.