A few months ago we installed a burglar alarm in our house. The company sent a trustworthy employee to do the installation, and he set the whole thing up for us. With sensors all over the house, it even knows when someone opens a door, and can sense the difference between our dog and a burglar – well that’s what the man told us and after all who are we to disagree. Along with the system comes an impressive panel that allows us to switch it on, and off, and do all kinds of clever things. It’s all described in the excellent documentation although we cannot understand how to use it. The biggest challenge is changing the code to get access to switch it off. We did try it once but gave up. Fortunately the helpful engineer set it all up for us so we don’t need to worry – or should we worry?

So whenever we go on holiday and switch it on, the friendly company that also monitors our house know that we are away, and the taboo topic between my wife and I is the code – Is the trustworthy employee still employed? We simply don’t know.

Well it seems that we’re not alone in this concern about unchanged code. It seems that many if not all IT Auditors, CSOs, and IT security staff, live daily with the fear of the “never expiring password” being exposed. It is the unspoken taboo – the wide open back door in every corporate network today. It is virtually certain that there is not a single business critical application in your company that isn’t wide open. Do you ever wonder how it is that information such as credit card details, personal data, intellectual property, seems to always be so vulnerable. You would think that companies had adequate security precautions to stop this happening, and yet it continues to be a problem.

So where is this wide open back door? In every one of your applications.


When, for example, a user accesses a web based application through a Portal, behind the scenes an awful lot of activity takes place to present the information to the user. This information is stored on systems and databases in your organisation. In order to access these resources, the Portal uses service accounts created on the systems to access the data.

The challenge of securing, managing and sharing the service accounts becomes a major overhead issue for IT departments and application managers in your organisation. The Service Account Passwords that enable applications to communicate with each other must also be managed as they present one of the biggest security backdoors.

In order for these applications to get access to data, they have to “logon” to the systems and applications that store the data, and since the credentials to logon are in the application, they are embedded in the code. Now since it is clearly impractical to rewrite applications on a regular basis, just to change the user ID and password, the result is that the user ID and password never changes. So what’s the big deal you might ask? Well there are a number of things.