SSH keys are part of a protocol that guarantees the protection of IT systems during data transfer between servers and computers and are used by organizations that need to communicate with systems and manage them securely. 

However, most companies manage their SSH keys improperly, which puts their security at risk. For this reason, we prepared this article, in which we cover the importance of the SSH protocol, its history, benefits, how it works, and much more. Read it until the end and understand better about this subject.

The use of SSH keys is an extremely important measure for organizations that need to communicate and manage systems securely. Nevertheless, for this procedure to really provide the necessary security, it is essential to adopt good practices.

We start our text by sharing two news stories about breached SSH credentials. The first case took place in 2019, but it was only identified in 2020, and it involves the website host company GoDaddy.

The domain registrar announced it had become the target of a breach that affected the SSH credentials of approximately 28,000 users at the time. A malicious actor would have bypassed its security systems and accessed SSH login data hosted on its servers.

There were no major issues, but its users have been notified about it. In addition, the company reset the usernames and passwords that were exposed and blocked the unauthorized party.

In 2021, GitHub received a warning from developer Axosoft about the vulnerability of a dependency on their git GUI client – GitKraken, which was generating weak keys. Therefore, it revoked all keys generated by vulnerable versions of the client used on GitHub.com.

Other possibly weak keys generated by other clients that could have used the same vulnerable dependency were also revoked. The company still needed to implement safeguards to prevent vulnerable versions of GitKraken from adding weak SSH keys created by older versions.

These two facts demonstrate that large organizations have managed the SSH protocol improperly, creating vulnerability for their systems.

Therefore, we prepared a special content, in which we show you everything you need to know about SSH keys. To facilitate your understanding, we divided our text into the following topics: 

1. SSH Protocol: What is It and Why is It Important?
2. Learn About the History of SSH
3. Learn About the Benefits of SSH Key Authentication
4. What Are the SSH Key Types?
5. Learn How an SSH Key is Generated
6. How SSH Key Access Works
7. How to Strengthen the Security of SSH Keys
8. SSH Key Encryption Categories
9. Data Related to the Security of SSH Keys
10. Management of SSH Keys by senhasegura
11. Conclusion

Follow the whole content!

1. SSH Protocol: What is It and Why is It Important?

Currently used in servers and datacenter environments, SSH consists of a protocol that allows the transmission of data, enabling the encapsulation of applications.

With SSH keys, system administrators and application developers have interactive access to remote systems securely. It is a feature widely used in database updates, backups, automated systems management, and system health monitoring applications.

In practice, SSH keys play a very important role in the functioning of automated digital networks used in data centers and businesses in general.

This solution guarantees encrypted connections with other systems, platforms, and networks that can be distributed in different environments, remote or in the cloud.

SSH keys replace isolated security techniques that are useful for encrypting data transfers. However, this use needs to be properly protected, analyzed periodically, documented, and managed systematically. If this process is not taken seriously, the security of the entire environment is at risk. 

2. Learn About the History of SSH

The first version of the SSH protocol was created in the 1990s by the researcher Tatu Ylonen at the University of Helsinki. At the time, a sniffing attack on the university’s network was discovered, capable of intercepting and recording network traffic and revealing usernames and their passwords to malicious actors.

As a result, thousands of credentials were breached. For this reason, the researcher started looking for ways to make networks more secure, developing the SSH protocol.

Currently, SSH keys are used to log in from one system to another remotely. Also, the security provided by encryption makes it possible to perform functions such as: issuing remote commands and managing network infrastructure and other vital system components remotely. Therefore, this tool is essential nowadays, characterized by the trend of remote work.

Before using SSH keys, it is necessary to install some software: while remote systems must necessarily have software called SSH daemon, the system used to issue commands and manage remote servers requires software known as an SSH client. This is the only way to create an appropriate communication channel using the SSH protocol.

3. Learn About the Benefits of SSH Key Authentication

SSH keys have the function of encrypting traffic between server and client. In practice, this means that if someone decides to spy on this traffic, they will not be able to decrypt the data properly. 

This solution also provides protection against brute force attacks and attack vectors used to access remote machines. With public-key encryption, there is no need to send passwords over the network, which provides more security.

Another advantage of SSH keys is the possibility of keeping a company in compliance with security regulations, but for this, it is necessary to generate, store, manage, and remove them following certain guidelines that guarantee the necessary protection.

There is a massive amount of SSH keys that can be used at any time by an organization. Therefore, it is recommended to use software to manage them and reduce risks.

4. What Are the SSH Key Types?

SSH keys provide security and cost savings to cloud and other computer-dependent services if managed properly.

This feature has a similar function to that of passwords, since they grant access, controlling who will access the system. To perform this management, it is necessary to adopt security policies, as it must be done with user accounts and passwords. 

We also emphasize it is the control of SSH keys that provides continuous availability, confidentiality, and integrity to the systems, as long as public-key encryption is used. 

These keys are categorized according to their function as: user keys, host keys, and session keys. Check it out:

• User Keys

Here, we are talking about authorized and identity keys, used to grant login access to users. Its authentication mechanism is known as public-key authentication. 

These identity keys are used by SSH clients to allow users to authenticate when logging into SSH servers. 

• Host Keys

This type of key is intended to authenticate computers, preventing man-in-the-middle attacks. This authentication is certificate-based and can be very useful for organizations.

These authentication keys must secure all connections, and one of the characteristics of SSH is to remember the host’s key when connecting to it for the first time. 

• Session Keys

Session keys have the function of encrypting most data on a connection. This key is negotiated during connection initialization. It is then used with symmetric encryption algorithm and an authentication code algorithm that ensure data protection.

5. Learn How an SSH Key is Generated

They are generated in pairs that bring together a “public” and a “private” SSH key. In this process, complex algorithms are used, so that it is unlikely to falsify or identify the private key, even if the public key is known. 

Thus, one must keep the private key secret, being used only by an authorized user. Public keys can be shared with others. 

To generate SSH keys, one needs to enter information such as passwords. Generally, short phrases are used to generate public and private keys.

Having an efficient password policy is critical to the cybersecurity of companies. Since using easy-to-identify passwords is a way to facilitate scams by malicious actors. For the same reason, repeating passwords is a risky practice.

In 2021, more than 8.4 billion passwords from people all over the world were leaked and posted under the name ‘rock you 2021‘ in an online forum. What did they have in common? They used between 6 and 20 characters, without spaces, numbers, or symbols.

Other characteristics of easy-to-steal passwords are: using birthday or algorithms with repeated numbers, proper names, numerical combinations, and the word Brazil are also often found in leaked passwords of Brazilian users, in addition to the sequence 123456.

We have prepared this article especially to help you keep your company protected. In it, we will propose positive actions for an effective password policy. They are as follows:

• Change Passwords Frequently

• Use Software that Alerts You About the Change

• Join an Account Lockout System

• Train Your Employees

• Do Not Use the Same Password for All Accounts

• Create Strong Passwords

• Have a Password Manager

• Adopt Multifactor Authentication in Your Company’s Routine

Read it until the end!

Why Should You Adopt a Secure Password Policy?

We know hackers take advantage of the weakness of corporate passwords in most cyber-invasions. 

Therefore, regardless of the size or industry of an organization, it is essential to have a secure password policy. After all, by adopting it, one avoids invasions that generate inconvenience and financial losses, in addition to preventing the company’s credibility from coming into question.

In practice, the password policy establishes rules to be followed by the entire team, ensuring the adoption of security requirements when creating passwords for accessing corporate devices and systems.

In the next topic, we cover some criteria you should adopt when establishing a password policy for your business. 

 

Positive Actions for an Effective Password Policy

You now understand the importance of creating a secure password policy for your company. Now, let’s show you how this can be done. Keep reading our text!

• Change Passwords Frequently

It is believed that using the same password in different applications and services can facilitate the access of malicious users, and when we reduce the number of accesses with the same password, we also reduce the possibilities that they are shared and available for access by third parties.

However, the usefulness of this measure has been questioned. Microsoft itself stopped asking for the periodic change of passwords, considering this method useless. According to this report in Isto É Dinheiro, Aaron Margosis, a cybersecurity consultant at Microsoft, stated it is necessary to change the password only if it is stolen.

Despite this debate, the periodic change of passwords has still been recommended, for this reason, we explain about software that emits alerts when it is time to change them in the following topic.

• Use Software that Alerts You About the Change

There is specific software that warns about the need to change passwords. They work as follows: when you try to access the computer after some time, you see a pop-up, warning you about the need to change your password to proceed. If you don’t, you will not be able to access the system.

These pieces of software are very useful because, over time, it is very common for people to get comfortable and fail to change their passwords within a certain time.

• Join an Account Lockout System

Blocking accounts is a very important practice that prevents access after a certain number of attempts. This feature prevents the user from trying to access a system by testing multiple passwords until they reach their goal. This practice is known as brute force and is often used by malicious attackers to gain unauthorized access to these systems.

To get a sense of the importance this feature has, it is widely used by e-mail services and various websites.

• Train Your Employees

If you are at the head of an organization, you should know that in addition to investing in technology to ensure information security, you need to train your employees through awareness and training to make it possible to identify and avoid threats.

Many people are unaware of the risks involved in accessing corporate systems. In these cases, it is necessary to introduce good practices and enforce them to prevent cyberattacks, including password theft. 

It is also important that these pieces of training are constant, since technology advances every day, as well as the techniques used by malicious agents.

• Do Not Use the Same Password for All Accounts

If someone manages to steal your password from social media, for example, it is very likely they will test it on your other services, causing much more damage if you use the same password to connect to different online platforms.

Therefore, when establishing a password policy, remember to recommend that your employees have a different password for each online environment they access.

• Create Strong Passwords

It is not enough to use passwords to access systems. It is necessary to resort to strategies that make it possible to increase the security level of the passwords used. After all, hackers often analyze users and attempt the invasion by testing obvious possibilities such as birthdates, relatives’ names, and short words.

In these cases, we recommend using a minimum number of digits, combining uppercase and lowercase letters, numbers, and symbols.

• Have a Password Management Solution

If you follow the fifth and sixth tips in this article, your employees will have to remember a lot of complex passwords, which can be quite difficult. That’s where a password management solution comes into play.

This feature is capable of storing passwords, facilitating the work of users, who only need to remember the password used to access this system. What’s more, password managers still suggest codes that are unlikely to be discovered. 

Of course, like all other apps, they can be breached. Therefore, it is essential to use an extremely secure master password.

• Adopt Multifactor Authentication in Your Company’s Routine

One of the ways to create a secure password policy is to adopt multifactor authentication (MFA). This solution brings together different mechanisms to prevent intrusions, which are:

• Knowledge Factor: something the user knows, such as a password;
• Ownership Factor: something the user owns, such as a token; and
• Inheritance Factor: something that relates to who they are, as in the case of biometrics.

But remember an important detail: in the multifactor authentication, the mechanisms must be independent of each other to guarantee the protection of a system. This means that if one of the factors gives access to the other, your organization is not protected.

By reading this article, you learned what you should do to create an effective password policy for your organization. Did you like our text? Share it with someone else who is interested in the topic. 

 

ALSO READ IN SENHASEGURA’S BLOG

High Availability: Technology that Guarantees Productivity and Credibility

China has Published Its Specific Law For the Protection of Personal Data. What Are The Implications?

My Company Suffered a Ransomware Attack: Should I Pay the Ransom or Not?