Privileged passwords create hacking threat

Privileged passwords exist in virtually every device or software application in an enterprise

Privileged passwords are more common in enterprises than previously thought, and their uncontrolled use makes organisations more vulnerable to hackers, a new study has revealed.

Privileged passwords are non-personal passwords that exist in virtually every device or software application in an enterprise, such as 'root' on a Unix server, 'administrator' on a Windows workstation, and 'cisco enable' on a Cisco device.

A survey by US information security vendor Cyber-Ark Software suggests that around half of the 140 enterprises that responded were using more privileged than individual passwords. 

The security loophole is exacerbated because 42 per cent of respondents said that they never update passwords regularly, which leaves organisations weak when faced with audits and hacker attacks.

"Organisations often believe that, because they have a small number of IT administrators, they cannot have many privileged passwords," said Adam Bosnian, vice president of products, strategy and sales at Cyber-Ark.

"The truth is that privileged passwords come pre-loaded on to virtually every piece of hardware and software in an enterprise and are therefore extremely common."

According to the 2006 Enterprise Privileged Password Survey, the typical enterprise contains more than 500 employees, each of whom has an Administrator account associated with their workstation.