No glitch, just poor key management

Imagine my surprise when I opened today’s Washington Times and saw an above the fold article titled “Glitch Imperils Swath of Encrypted Records.”  It’s already getting pretty deep.

“In the worst-case scenario, most of the data on the servers of every company in  the developed world gets wiped out,” Tatu Ylonen, chief executive officer of SSH  Communications Security Corp., told The Washington Times.

Seriously?  Why not throw in some claims about digital pearl harbor?

Ylonen goes on to say that it would take hours to write a virus that exploits SSH weaknesses and spread from machine to machine.

It took far to long to wring from this article what exactly they are talking about.   Turns out its key management.

SSH is an encrypted network protocol.   At the time it was developed, telnet was predominantly in use.   SSH was designed to solve the issue of data confidentiality in transport (as information moves from your computer to a server) and provide mutual authentication (both sides know they are talking to a valid party).   While username/passwords are commonly still used to authenticate to the remote server while using SSH, it is also possible to authenticate using a certificate.    The danger is when the certificate isn’t stored securely.   If there is no password required to use a certificate, anyone with access can use it.    At large companies, many certificates get issued over time, and employees come and go.   If certificates aren’t protected and revoked as people leave, you have an access control issue.

For a few months now, Tatu Ylonen, creator of SSH, has been talking about key management.   Not surprisingly, his company has a solution for sale.

<Edit>  Today’s SANS blogger picked up the story, highlighting the problem of key management rather than the story problems..