Cyber-Ark Software Closes The Application Security Backdoor
London – 13 February, 2006 – Cyber-Ark(r) Software Inc., the information security software that develops and markets digital vaults for securing and managing highly-sensitive information within and across global enterprise networks, today announced the release of its support for application to application passwords. The Enterprise Password Vault solution for securing, sharing and managing administrative passwords has now been enhanced to support the management of application to application passwords, also frequently referred to as embedded accounts.
Password Vault provides a “safe haven” where all privileged passwords can be securely archived, transferred, shared and managed by authorized users, such as IT staff and administrators. It creates a centralized credential management infrastructure to secure all privileged accounts and passwords. The Central Password Manager module enables organizations to change passwords automatically on remote machines and store the new passwords in the Vault, without human intervention and in accordance with organizational policies. The added capability to manage embedded accounts allows the software to remove hard-coded passwords from all scripts and code, encrypt stored passwords and control all access to credentials by application or support staff. These enhanced Administrative ID management capabilities further enable corporations to comply with the latest regulatory requirements.
“The risks related to embedded accounts has now become a focal point for those responsible for ensuring compliance” said Calum MacLeod, Cyber-Ark European Director. “There are literally tens of thousands of publicly accessible applications, from internet banking, government applications, healthcare, etc., that are simple to exploit because developers are either using default settings, or relying on pre-packaged scripts available on the web. The result is that organisations are vulnerable to external and internal exploits and frequently will not even know they have been victimized.”
“These embedded accounts are an often overlooked security concern,” said Udi Mokady, Cyber-Ark President and COO. “If a high-level password falls into the wrong hands, it can have devastating results on a company’s reputation and financial standing. Moreover, managing these passwords has become a logistical nightmare for IT departments. The Password Vault provides the most effective way to manage and protect sensitive passwords. This latest version speaks to the needs of IT departments for considerable ease of use and flexibility.”
The challenge of securing, and managing these accounts within the enterprise is a major issue for IT departments and application managers. The passwords that enable applications to communicate with each other must also be managed as they present one of the most vulnerable backdoors for any enterprise organization.
These passwords are often hard coded within applications, so resetting them becomes a complex process involving changes to application code, compilation and in some cases a long process of transferring the code from development to QA to production. To alleviate these headaches and the associated downtime, passwords often remain unchanged. Even worse, administrators have had no mechanism to disable passwords once they’re given out. This means former employees, MSP staff, offshore developers and others may have access to the company’s most valuable assets.
Cyber-Ark’s Vaulting Technology provides an effective way to safeguard these passwords. This software encompasses a very secure repository for passwords and password objects, as well as a central password manager. The password manager forces users to comply with stringent password policies. Instead of the system administrator manually assigning passwords and tracking these in a spreadsheet, the password manager generates a password that automatically changes or expires. For example, a developer may be given a password authorizing him to access the server for 60 minutes, or for one-time use. Passwords on target systems are changed on a predefined basis. This is ideal for users who may need to get to the server for a specific purpose but should not be given permanent access.
Cyber-Ark’s patented Vaulting solutions allow organizations to protect and share information both over the Internet between discrete enterprises and manage critical information within a single network. The company’s technology is used to secure the most valuable assets of some of the largest military, banking, manufacturing, airline and governmental enterprises in the world. Password Vault is an extension of this technology specifically built for administrative passwords. Cyber-Ark’s Password Vault offering provides a ‘Safe Haven’ within the enterprise where all administrative passwords can be archived, managed and shared.
About Cyber-Ark
Cyber-Ark Software is an Information Security company that develops and markets digital vaults for securing and managing sensitive information within and across global enterprise networks. Based on it’s patented Vaulting Technology(tm), Cyber-Ark’s digital vault products include: The Inter-Business Vault, a secure infrastructure for cross-enterprise data exchange of highly-sensitive information; The Sensitive Document Vault, which allows enterprises to secure, store and manage highly-sensitive documents; and the Enterprise Password Vault, which provides solutions for secure storage and management of administrative, emergency and service account passwords. Today Cyber-Ark enjoys strong customer relationships with more than 150 Global 1000 companies around the world.