How Big Is The Risk ????

[tsmnovice]

I started working for this company and was shocked to see that the TSM server

on AIX platform has the password as 'admin' for the TSM ' admin' userid. They have not

changed it in the last 5 years since TSM was first installed. How big of a security risk is

it ? It doesnt look like the Auditors even noticed it in the last 5 years .

Is this a safe practice leaving the password for 'admin' userid as 'admin' ?? If some hacker

notices this within the comapny, what kind of a risk are we looking at ??

Thanks in advance for thoughtful responses !!!

 

[Harry_Redl]

Hi,



well, it depends on how easily is the TSM accessible - if the Web Interface or command line tool can connect from any IP within the company, then anyone guessing the password (trying default) has complete control over the TSM. So he/she can delete any filespace, mess with your retention settings, RESTORE ANY CONFIDENTAL DATA ... it is definetely not a good thing ...

If the web interface is disabled (or firewalled) and the administration commandline tool is set to another port (using tcpadminport in dsmserv.opt on the server) and firewalled to allow access only from trusted (administrator's) IP then it can be safe ....



But generally I would consider it as a serious risk ... and it takes 10 seconds to change the password



Hope it helps



Harry

 

[sgabriel62]

I'm in agreement with Harry - upon installation and the registration of the first admin with system level privileges, the default admin and client accounts should be disabled and/or locked. Consider admin account - root for TSM - once you're in, your're in and all that data is just a glowing.

As a previous Sec Admin, in one of my last positions, an auditor knows which application default accounts to disable and which ones need to remain open.

Again, level of risk, - ask yourself this question. If it was your data and you considered it confidential no matter how trivial and you do not want outsiders looking in - you'd take the actions to prevent it wouldn't you. Consider your employer your data and present this risk assessment to anyone who argues with you.



Good luck

Steven