Krebs is reporting that Orvis, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on Pastebin.com for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.
Experts have commented below.
Each newly reported data breach or data exposure incident brings to light how much access some employees have, and also, what are some not-so-well-known places where exposed data or credentials may show up (Pastebin?).
Some privileged employees may certainly have a need or directive to possess ‘keys to the technology kingdom.’ They may also find it challenging to keep the dozens of user names and passwords securely managed, yet accessible, to perform their day-to-day responsibilities. But it is clear that organizations need additional data protections beyond access safeguards to ensure their ‘crown jewels’ are kept secured.
Orvis is fortunate that no reports of customer data were leaked, as this 160-year-old retailer may have had to answer data privacy questions as cited in several regulations in jurisdictions in which they do business.
Keeping track of passwords within the business gets complex when you’re using local accounts. It’s important to have a centralised identity and access management system to protect not only user accounts, but also devices like routers, switches and firewalls. Using local or shared accounts requires some type of repository to store the credentials and when these are accidentally posted in uncontrolled environments, it can open opportunities for unauthorised use, which can lead to intellectual property theft, identify theft or business email compromise. If a central repository needs to be used, it is more effective to have a proper password management system for organisations that is protected on the network and only accessible by authorised users.