A posting from Dark reading in there Database Security Section:

A “gaping hole” in the way enterprises govern the use of one of IT’s least sexy but most used access control and encryption protocols is leaving many sensitive database servers and other network devices at serious risk.

Secure Shell (SSH)–a Swiss army knife in the arsenal of many an IT department–is best known for aiding in the creation of encrypted tunnels to secure remote access and file transfers, but has gradually gained even more acceptance as a way to secure machine-to-machine connections to help enterprises move large amounts of valuable and sensitive data.

But experts say that enterprises do such a poor job managing the public/private key pairs upon which the protocol depends that they’re putting many of their most sensitive data assets at risk, including database servers that use SSH to connect with applications that tap into them.

According to Charles Kolodgy, analyst for IDC, at most enterprises the internal means by which organizations manage their SSH keys are “often clumsy and decentralized.” What’s more, when organizations do take steps to secure use of keys by central access by only a few privileged administrators, they often don’t monitor those privileged insiders for policy violations, creation of rogue keys or other suspicious behavior that could put the security of SSH communications in jeopardy.

To real more click here: