San Francisco Lockout – Found Guilty: the city or the admin?

After years of public acrimony and a 6 month trial, San Francisco IT administrator Terry Childs has been found guilty of hijacking the city’s computer system.  Cyber-Ark has always maintained that this was more than simply a case about a rogue employee, but in fact an example of an organizational failure in managing and effectively taking ownership of privileged accounts and identities.  At the end of the day, all organizations have the responsibility to control the power they provide to their employees.  This case highlights what can happen when an organization fails at accomplishing this task. Privileged accounts and users provide widespread access to high-value networks, systems and applications in any organization.  The problem is that too many still don’t believe they have a privileged issue, or simply haven’t taken the steps to address the underlying problem.  The root cause of this internal threat is that privileged accounts convey broad and deep access privileges that cannot be traced to a specific person. They are often neglected and session activities are difficult to monitor due to their anonymous nature, while privileged passwords can be hard coded inside applications, scripts and parameter files, leaving them unsecured and rarely changed. The mismanagement of shared administrative accounts and embedded passwords is also one of the main reasons why organizations fail compliance audits. To proactively address these vulnerabilities, organizations must ensure that administrative and application identities and passwords are changed regularly, highly guarded from unauthorized use and closely monitored, including full activity capture and recording. By automating these tasks, passwords are automatically refreshed at regular intervals, and they are disabled immediately when an employee leaves the company. In the end, hopefully this case serves as a much needed wake-up call to the power a privileged user wields.  Organizations of all types – from companies to public agencies – need to understand that this isn’t simply about a rogue insider that may lurk inside the IT department.  It extends to anyone who has access to privileged information and processes. The problem starts and ends with an organization upholding their responsibility to manage, control and monitor the power they provide to their employees.