Skip to main content

Four Hidden Costs and Cybersecurity Risks of sudo

By: Morey Haber, chief technology officer, BeyondTrust

It is always a philosophical debate as to whether to use open source software in a regulated environment. In the case of ‘sudo’—a package designed to provide privileged access included in many Linux distributions—the debate is whether it meets the requirements of an organization, and to what level it can be relied upon to deliver compliance information to auditors. While every organization is different, there are four specific risks/costs that you should consider before deciding if sudo is right for your organization.

Administrative Costs
With sudo, you need to run a third-party automation management system (like CFEngine or Puppet) and third-party authentication modules on the box. Furthermore, if you plan to externalize the box at all, you are going to have to replace sudo with the new vendors’ version of sudo. So, you essentially end up maintaining sudo, a third-party management system, a third-party automation system, and additionally, may have to replace it all if you want to authenticate against something external to the box.

Another complexity with sudo is that everything is local, meaning it can be extremely time-consuming to manage as environments grow. With sudo, you have to rely on local systems on the server to keep logs, rotate them, send them to an archival environment, and ensure that no one is tampering with any of the other related subsystems. This can be a complex and time-consuming process.

Forensics & Audit Risks
Administrative costs aside, arguably a far greater risk is that of not being able to produce log data for forensic investigations.

There is currently no keystroke logging within sudo, and since any logs of sudo activity are stored locally on servers, they can be tampered with by savvy administrators. sudo also lacks log integrity – no chain of custody on logs – meaning logs can’t be non-repudiated and therefore can’t be used in legal proceedings in most jurisdictions. This is a significant risk to organizations, especially in criminal prosecution, termination, or other disciplinary actions. Another concern with sudo is that the change management processes can’t be verified. Best practices call for review ofchange records, and validation that what was performed during the change matches the implementation that was proposed. ITIL and other security frameworks require validation of change management practices, something that sudo cannot do.

Furthermore, there is no session recording with sudo. Session logs are one of the best forensic tools available for investigating what happened on servers. It’s human nature that people tend to be more cautious when they know they can be watched. Finally, there is no segregation of duties with sudo. Most security and compliance frameworks require true separation of duties and using a tool such as sudo just “skins” over the segregation of duties aspect.

All of these deficiencies—lack of log integrity, lack of session monitoring, no change management—introduces risk when organizations must prove compliance or investigate anomalies.

Business Continuity Risks
By virtue of being open source, there is no indemnification if there is a critical error. Also, there is no rollback with sudo, so there is always the chance that mistakes will bring and entire system down with no one to call for support. Sure, it is possible to centralize sudo through a third-party tool such as Puppet or CFEngine, but you still end up managing multiple files across multiple groups of systems manually (or managed as one huge policy). With this approach, there is greater risk that mistakes will break every system at once.

Lack of Enterprise Support
Another risk associated with being open source is that there is no official service level for when packages must be updated to respond to identified security flaws, or vulnerabilities. Over the past several years, there have been a number of vulnerabilities discovered in sudo that took as many as three years to patch (CVE-2013-2776, CVE-2013-2777, CVE-2013-1776 ).

Benefits of Using a Commercial Solution
Although they come at a higher cost than free open source solutions, commercial solutions provide an effective way to mitigate the general issues related to sudo. Commercial solutions usually have a regular release cycle, and can typically deliver patches, in response to vulnerabilities, in hours or days from the time the vulnerability is reported. These solutions provide event logging on separate infrastructure that is inaccessible to privileged users which eliminates the possibility of log tampering. They also provide strong, centralized policy controls that are managed within an infrastructure separate from systems under management; this eliminates the possibility of rogue changes to privileged access policies in server environments. Strong policy control also moves security posture from ‘Respond’ to ‘Prevent’, and advanced features provide the ability to integrate with other enterprise tools, and conditionally alert when privileged access sessions begin, or end.

Conclusion
For organizations that are serious about incorporating a strong privileged access management into their security program, there is no question that a commercial product is better suited than an open source offering such as sudo. Eliminating the possibility of malicious behavior using strong controls, centralized log file collection, and centralized policy management is far better than relying on questionable, difficult to manage controls delivered within sudo. In calculating an acceptable level of risk to your tier-1 Unix and Linux systems, all of these costs and benefits must be considered. If in doubt, remember the old adage—there is no such thing as a free lunch!

Comments

Popular posts from this blog

Cloud Computing powering India’s priority of ‘Digital-first country’

By: Sunil Mahale, India MD and VP, Nutanix
Digital transformation has been recognized as being vital to the growth of our nation. This transformation has enjoyed the unanimous approval and contribution from all stake holders including enterprises, MSMEs, government bodies and citizens. But this level of adoption in a country with a population of over a billion people would need a robust technology base that is capable to collecting and distributing vital data seamlessly.
Digital India envisions creating high speed digital highways, that will impact commerce and create a digital footprint for every individual. Technologies based on mobility, analytics, Internet of things and most importantly, cloud technologies are the building blocks for the digital India missionThere is a growing need to manage huge volumes of data, and making them readily available to public through digital cloud services. Cloud has a pivotal role in enabling this change.
While Data centers have become crucial to th…

RevStart launches its RevItUp Incubation Programme

Underlining its vision of creating a nurturing ecosystem for start-ups to grow in, RevStart, a co-working and incubation centre, has announced the launch of its RevItUp Incubation Programme. The 12-week long programme will be held at RevStart Incubation Centre in Noida from July 1, 2018 onwards. As part of the programme, RevStart will select five high potential start-ups from the ed-tech sector, AI, Consumer Internet, Sustainability, as well as for-profit social impact companies to assist them with developing their business, along with connecting them to global mentors across industries and sectors. In addition, start-ups selected for the programme will receive INR 5 lakh to Rs. 25 lakhs worth of cash and benefits, while RevStart will get an equity stake in the ventures.
The RevItUp Incubation Programme has been created to enhance the founding team’s industry, product, and company building knowledge and capabilities through a world-class curriculum. The programme will focus on tailor…

The Workplace of the Future

By: Arnab Ghosh – Director, Synergy Property Development Services)
Workplaces are undergoing a major transformation today to stay relevant. Conventional space planning and design approach for office space are slowly but steadily changing across the globe. What was a trickle a decade back is snowballing into a movement as we speak? The nature of the work we do and the time we spend in our workplace is driving this change. 
The Social Workplace The original office in the west was originally based on the factory floor design. The Workers occupied the maximum space followed by Managers and the Senior Executives in their glass cabins. The term “productivity” also has industrial roots. There were well-defined tasks and targets for the employees to achieve in their working time. All these have changed drastically over the last few decades and going to change further in the future. The culture of organizations has to adapt to this change to stay ahead and retain talent. Productivity is no long…