SSH – Does Your “Cloud Neighbor” Have an Open Backdoor to Your Cloud App?

Grazed from InfoSecurity. Author: Gavin Hill.

Secure Shell (SSH) is the de facto protocol used by millions to authenticate to workloads running in the cloud and transfer data securely. Even more SSH sessions are established automatically between systems, allowing those systems to securely transfer data without human intervention. In either case, this technology underpins the security of vital network communications. According to the Ponemon Institute, organizations recognize SSH’s role in securing network communication and list threats to their SSH keys as the number one most alarming threat arising from failure to control trust in the cloud.

SSH authentication holds only as strong as the safeguards around the authentication tokens, the SSH keys. Failure to secure and protect these keys can compromise the environment, breaking down the trust that SSH should establish. Malicious actors take advantage of common mistakes in key management, the following are some of the common pitfalls organizations fall prey to…

The Weakest Link

Malicious actors often target SSH keys because SSH bypasses the authentication controls that typically regulate a system’s elevated privileges. In their efforts to exploit SSH, malicious actors naturally focus on compromising the weakest link in a highly secure protocol – human error and mismanagement of the private SSH keys…

Read more from the source @ http://www.infosecurity-magazine.com/blog/2013/10/30/ssh–does-your-cloud-neighbor-have-an-open-backdoor-to-your-cloud-app/1040.aspx