topic Re: security issues with SAS Internal ID's? in Administration and Deployment

security issues with SAS Internal ID's?

Cherry — Wed, 13 Nov 2019 02:37:27 GMT

Hi,

currently we have created some sas internal user id's for a set of associates for special purpose to view few reports on SAS VA, we should not allow them to use external id's ( they are not in our AD group).

I would like to know is there any security issues raises when they use internal sas id's? if yes please elaborate them? also advise how to mitigate the risk?

Appreciate your help.

Thanks,

Cherry.

Re: security issues with SAS Internal ID's?

SASKiwi — Wed, 13 Nov 2019 05:57:20 GMT

SAS internal IDs must have their passwords stored with them in a SAS metadata repository. These passwords are stored in an encrypted form. OS userids do not normally have passwords stored in SAS metadata, so from that perspective they are more secure.

Perhaps the biggest risk with SAS internal IDs is their passwords are static and there is no mechanism to have them expire automatically so they get changed on a regular basis. So to mitigate this risk you could have a policy of updating them on a regular basis. It is advisable to have these IDs stored in your company's password safe, so they aren't lost.

Re: security issues with SAS Internal ID's?

Cherry — Wed, 13 Nov 2019 06:31:34 GMT

can we get the audit logs of sas internal id's activities? I mean can we track what they ( sas internal id's) are doing on sas?

Thanks,

Cherry.

Re: security issues with SAS Internal ID's?

andreas_lds — Wed, 13 Nov 2019 07:01:10 GMT

@SASKiwi wrote:

[...]

Perhaps the biggest risk with SAS internal IDs is their passwords are static and there is no mechanism to have them expire automatically so they get changed on a regular basis. So to mitigate this risk you could have a policy of updating them on a regular basis. It is advisable to have these IDs stored in your company's password safe, so they aren't lost.

Automatic password expiration seems to be possible (using 9.4m5):

Re: security issues with SAS Internal ID's?

SASKiwi — Wed, 13 Nov 2019 19:05:40 GMT

@andreas_lds - Thanks for pointing that out. We use 9.4M2 and expiring internal accounts is possible in M2 as well.