|
"The results of this study clearly show the very uncomfortable situation for IT administrators, who, as employees, are subject to the instructions of their superiors and yet must carry out their duties in compliance with existing legal rules or risk being held personally liable," says Jean-Noël Galzain, CEO of Wallix. We mustn't forget that the administrator's role lies at the point where these two obligations meet. There is a document on the AFCDP website entitled "Technical Administrators, Rights & Obligations", which describes a case that led to the conviction of a network manager and his superior, in which the court found that these professionals had abused their position and the technical possibilities available to them." In fact, the AFCDP (the French association of personal data protection correspondents) recommends drafting a charter specific to this professional category and raising their awareness of the legal context. IT professionals are hardly setting an example when it comes to confidentiality. We also learn that most of them still write down the most critical passwords on Post-It notes, and 8% even admit leaving the passwords set by default by software publishers...which are well known to all hackers. Jean-Noël de Galzain confirms that "The easiest way to infiltrate a company's network is to look for administrator passwords that have been left blank or with the default set by the publisher, such as "admin" or "password"... Once you have found these passwords, you are inside the company's IT system with the highest level of privilege and authorisation. You control the company's entire IT system." These risks are confirmed in a study published by CERT at Carnegie Mellon University's Software Engineering Institute and the US Secret Service entitled "Comparing Insider IT Sabotage and Espionage": in 86% of cases, the attacker is a man with a technical role. Revenge is the primary motivation for 92% of them. The report confirms that "in insider IT sabotage cases, the saboteurs were typically system administrators or privileged users [who] have total access to at least some portion of the organization's system or network". One of the thirty cases studied involved an administrator who accessed the NOC (network operations centre) on a Friday evening: "The insider deleted the entire database and all software, [...] shut down every system, and stole every backup tape... " The report states that "In 28 of the 30 IT sabotage and all of the espionage cases [...] lack of physical or electronic access controls – or both – facilitated the illicit acts." Closer to home, the CNIL has recently pointed to security flaws in the Personal Medical Record (DMP), including passwords that are too easy to deduce. In the same vein, the study also states that 20% of administrators admit they do not change the most critical passwords often enough; the most common answers were: "No idea! ", "Not often", "When management tells us to", "Every year", "Never". This is all the more surprising when we discover that 68% of these same IT professionals consider they could pass an unscheduled security audit!
|
