A survey by US information security vendor Cyber-Ark Software has found that a large number of privileged passwords are in use in enterprises - much more than previously estimated. These include such accounts as 'root' on a UNIX server, 'administrator' on a Windows workstation, and 'cisco enable' on a Cisco device - and many of these are still using default passwords! The survey found that, of the 140 enterprises that responded, half were using more privileged than individual passwords.
Using weak passwords on these accounts represents a big security risk, and yet many firms are failing to take the threat into account.
Six out of 10 IT pros quizzed in the survey said that their organization has been hacked. It's not as if IT admins are unaware of the problem either - half of all IT professionals are often or always concerned about passing audits.
The survey draws to the conclusion that although privileged passwords are more powerful, they are less likely to be changed, and that this represents a significant security risk. Indeed, router passwords are hardly ever changed, and local workstation privileged passwords are never changed in 21 per cent of cases.