Search

COMMENTARY
INFORMATION TECHNOLOGY | Contributed Content, Singapore
Published: 10 Aug 12
859 views


Tommi Lampila

3 challenges in user key management

BY TOMMI LAMPILA

Singapore, as an international city and the regional business and financial hub of Asia Pacific, has been inextricably in line with international standards of excellence.

While the adoption of the PCI-DSS and Sarbanes-Oxley Act (SOX) SOX standards began among North American organizations, multinational companies with global presence are adopting the standards and compliance efforts centred on them are increasing. For example, companies that need to be compliant with PCI-DSS also require their partners that exchange and co-process credit card data, to maintain the compliance.

Early before the development of the compliance requirements, global enterprises have adopted Secure Shell (SSH), a network protocol invented in 1995 for securing data communication. Today over 3000 global organisations use the SSH data-in-transit solution for moving information, including 7 of the Fortune 10 and trends have shown that there is an increase of SSH usage in the financial industry to meet compliance in recent years.

For these enterprises, the most critical enterprise data and applications are often transported and housed on SSH and OpenSSH servers. In order to access the data, user authentication is required. However, in today’s complex enterprise environments, it is nearly impossible to map the trust relationships between individual users, system accounts and application ID’s to their respective targeted destination SSH servers.

Enterprises typically have one or more IMS (Identity Management System) for their users, which usually does not encompass access to all systems and accounts across the enterprise and provides no visibility into user keys keys that provide access to the organizations most sensitive information.

Traditional manual approaches to managing user keys are not only time consuming and expensive; but also easily trigger manual errors in key setups. This not only poses a major security and compliance risk, but has also proven to be cost ineffective.

Challenges in managing keys

1. Compliance
Today the compliance standards are higher and even more specific on user key management. For instance, PCI DSS requires enterprises to “Protect encryption keys issued for encryption of cardholder data against disclosure and misuse.” and “Fully document and implement all key management processes and procedures”.

In addition, the ISO 27001-1 also specifies requirements for key management. Organizations need to expend more effort to comply with the more stringent requirements.

2. High cost
Setting up new keys and trust-relationships in traditionally manual way is complex. It is even more complex to rotate and remove the keys. The more dynamic the environments are, the more key operations are required. The widespread cloud and grid computing adoption has increased the burden of IT departments of many of institutions.

3. Growing risk
According to the IBM X-Force 2011 Trend and Risk Report, there were a large number of automated password guessing attempts directed at secure shell servers in the latter half of 2011.

In addition, the top 10 threat actions types by number of breaches within larger organizations, “Use of stolen login credentials” ranked no. 1, according to 2012 Data Breach Investigations Report by Verizon. The present situation calls for enterprises to seek ways to eliminate complex manual work, reduce risk of unauthorized access, improve visibility and meet compliance.

A logical three phased approach of user keys management The best practice of user keys management to overcome these challenges should include three phrases: discovery, monitoring and management.

First, the legacy environment of existing deployed private and public SSH keys and their associated users are discovered and manual errors and mismanagement in the past are then identified.

Thereafter, this environment is locked down and monitored, and the authorized users are linked to the respective servers via user and group information, as well as the defined access policies.

Finally, the environment is brought under automatic management, and user keys are automatically deployed, revoked, recertified and rotated according to changes in the operational environment and user repositories. 

The views expressed in this column are the author's own and do not necessarily reflect this publication's view, and this article is not edited by Singapore Business Review. The author was not remunerated for this article.

Tommi Lampila

Tommi Lampila

Tommi Lampila is the Vice President, APAC, SSH Communications Security. 

Contact Information



Sign up for our newsletter

 

Do you know more about this story? Contact us anonymously through this link.

Click here to learn about advertising, content sponsorship, events & rountables, custom media solutions, whitepaper writing, sales leads or eDM opportunities with us.

To get a media kit and information on advertising or sponsoring click here.

Tags: Tommi Lampila, SSH Communications Security, PCI-DSS Singapore, Singapore's enterprise environment, Identity Management Sytem in Sngapore

CO-WRITTEN ARTICLES & SPONSOR CONTENT ››

Professor Stephen Brammer from the Birmingham Business School says up to 50% of market value is at stake.
232 views

LATEST INFORMATION TECHNOLOGY JOBS »
  • No jobs posted on this category.
PRINT ISSUE »

Subscribe Now
Trains, planes, automobiles and drones

26 views

As goes Hong Kong, so goes Singapore?

331 views

Office property shows no signs of a slowdown

85 views

MOST READ EXCLUSIVES

Singapore's 10 most successful 40 and under hotel managers

Singapore\'s 10 most successful 40 and under hotel managers

Find out who's who in the hotel industry.

by KRISANA GALLEZO
12 Mar 2014 | 53768 views
 

Take an exclusive tour at TripAdvisor's 6,000 sq ft Singapore headquarters

Take an exclusive tour at TripAdvisor\'s 6,000 sq ft Singapore headquarters

It's like having a road trip while at work.

by CARMINA JARIEL
5 Feb 2014 | 19616 views

Singapore's top six Valentine’s Day hotels

Singapore\'s top six Valentine’s Day hotels

Ready to pop the question?

by KRISANA GALLEZO
29 Jan 2014 | 17493 views
 

Singapore's 6 hot new restaurants in April

Singapore\'s 6 hot new restaurants in April

Warm your belly with these top picks.

by STAFF REPORTER
1 Apr 2014 | 17443 views

Singapore's 6 hot new restaurants in February

Singapore\'s 6 hot new restaurants in February

Warm your belly with these picks.

by STAFF REPORTER
27 Feb 2014 | 15967 views
 

Singapore's 6 hot new restaurants in March

Singapore\'s 6 hot new restaurants in March

Get a taste of NYC's eclectic undergound dining.

by STAFF REPORTER
18 Mar 2014 | 13697 views

StarHub's corporate office is so awesome it has its own theatre exclusive to staff

StarHub\'s corporate office is so awesome it has its own theatre exclusive to staff

Check out its other facilities with these pictures.

by STAFF REPORTER
3 Mar 2014 | 8815 views
 

See how FireEye's Singapore headquarters could make hackers scared out of their wits

See how FireEye\'s Singapore headquarters could make hackers scared out of their wits

It's Singapore's threat intelligence hub.

by CARMINA JARIEL
21 Jan 2014 | 7632 views

Why are office rents suddenly the hottest topic in the property market?

Why are office rents suddenly the hottest topic in the property market?

Everyone has been buzzing about it.

by STAFF REPORTER
26 Mar 2014 | 5339 views
 

What could make 2014 a disappointing year for Singapore REITs?

What could make 2014 a disappointing year for Singapore REITs?

SREITs are in for a triple whammy.

by KAREN MESINA
22 Jan 2014 | 5096 views

Parco Marina Bay at Millenia Walk shuts down on 24 February

Parco Marina Bay at Millenia Walk shuts down on 24 February

Let’s call it a day, says management.

by CARMINA JARIEL
12 Feb 2014 | 4376 views
 

Should everyone be happy with falling private home prices?

Should everyone be happy with falling private home prices?

And will the cooling measures be relaxed by 2015?

by STAFF REPORTER
9 Apr 2014 | 3869 views

Find out how this 2-storey gallery-hostel in Singapore is painting the town red

Find out how this 2-storey gallery-hostel in Singapore is painting the town red

It has 18 rooms with 100 beds.

by STAFF REPORTER
27 Feb 2014 | 3762 views
 

Is Singapore's property market still haunted by liquidity nightmares?

Is Singapore\'s property market still haunted by liquidity nightmares?

Analysts are still unimpressed.

by STAFF REPORTER
5 Feb 2014 | 3133 views

Guess where cash-rich shoppers splurged their money over CNY period

Guess where cash-rich shoppers splurged their money over CNY period

Shop 'til you get tracked.

by STAFF REPORTER
14 Feb 2014 | 3118 views
 

Singapore Wine Vault's $200m facility slated to launch in 3Q

Singapore Wine Vault\'s $200m facility slated to launch in 3Q

It can house over 10 million bottles.

by STAFF REPORTER
5 Mar 2014 | 2909 views

How disappointing were the January home sales, really?

How disappointing were the January home sales, really?

Analysts are still keeping their hopes up for next month.

by STAFF REPORTER
19 Feb 2014 | 2528 views
 

Find out how this startup plans to beat Singapore’s skyrocketing car prices

Find out how this startup plans to beat Singapore’s skyrocketing car prices

It’s speeding up its Asian expansion.

by STAFF REPORTER
5 Mar 2014 | 2233 views

SingTel, StarHub stuck in a tight tug-of-war over 2014 World Cup broadcast rights

SingTel, StarHub stuck in a tight tug-of-war over 2014 World Cup broadcast rights

Negotiations are challenging, said StarHub.

by STAFF REPORTER
17 Feb 2014 | 2015 views
 

Singapore is world's most expensive city—but only for expats

Singapore is world\'s most expensive city—but only for expats

Is The Lion City still affordable to ordinary Singaporeans?

by STAFF REPORTER
6 Mar 2014 | 1954 views

Buckle up: Car sharing firms gain ground in Singapore

Buckle up: Car sharing firms gain ground in Singapore

Should car retailers be scared?

by CARMINA JARIEL
10 Feb 2014 | 1880 views
 

Singapore hoteliers saw flat Chinese New Year

Singapore hoteliers saw flat Chinese New Year

Business was challenging, they said.

by STAFF REPORTER
5 Feb 2014 | 1691 views

Singaporeans mine gold in ‘second hand economy’ amidst skyrocketing cost of living

Singaporeans mine gold in ‘second hand economy’ amidst skyrocketing cost of living

8 in 10 Singaporeans admit to purchasing pre-owned goods.

by CARMINA JARIEL
28 Mar 2014 | 1675 views
 

What does Singapore's 6.2% industrial production growth imply for the rest of 2014?

What does Singapore\'s 6.2% industrial production growth imply for the rest of 2014?

Analysts are delighted by it.

by STAFF REPORTER
29 Jan 2014 | 1433 views

How a horrible renovation experience inspired Kluje to build a home renovation empire

How a horrible renovation experience inspired Kluje to build a home renovation empire

Over 400 accounts created in its first 2 months.

by CARMINA JARIEL
5 Feb 2014 | 1360 views
 

Will Singapore banks break hearts with bad results on Valentine's Day?

Will Singapore banks break hearts with bad results on Valentine\'s Day?

Especially with the easing of debt servicing burden.

by STAFF REPORTER
12 Feb 2014 | 1311 views

See how Zalora's 24-hour online ad campaign boosts Singapore's music scene

See how Zalora\'s 24-hour online ad campaign boosts Singapore\'s music scene

It collaborated with local singer-songwriters.

by STAFF REPORTER
22 Jan 2014 | 1290 views
 

See how this startup lets you create free listings in less than 30 seconds

See how this startup lets you create free listings in less than 30 seconds

Forget about Craiglist or Gumtree.

by STAFF REPORTER
19 Feb 2014 | 1182 views

Singapore's most followed Google+ personality joins local startup

Singapore\'s most followed Google+ personality joins local startup

Check out how "SuperMommy" plans to take Tickled Media into another level.

by KRISANA GALLEZO
3 Apr 2014 | 1176 views
 

Self-storage firms find silver lining in Singapore's space crisis

Self-storage firms find silver lining in Singapore\'s space crisis

Less space, more money.

by CARMINA JARIEL
19 Feb 2014 | 1113 views
close Don't Show Again

STAY INFORMED! Get our free weekly newsletter