Story image

70% of firms would fail a privileged account management audit

15 Mar 18

Organisations may consider privileged account management an important part of their cybersecurity, however in reality many will still fail to protect and secure privileged accounts, a new study from Thycotic claims.

Out of 500 organisations worldwide, 60% state they are required to comply with regulations about privilege credential access, but 70% would fail an access controls audit. 80% consider privileged account management (PAM) security a high priority.

“While most organisations acknowledge the important role privileged credential access plays in their cybersecurity posture, our report finds that most are actually failing to protect and secure their privileged accounts,” comments Thycotic’s chief security scientist Joseph Carson.

The State of PAM Risk and Compliance report highlights that PAM is a required compliance issue driven by auditors and controllers.

According to the report, privileged access comprises “Access to computers, networks and network devices, software applications, digital documents, and other digital assets that upper management, IT administrators, and service account users work with daily. Access to privileged accounts allows more rights and permissions than those given to standard business users”.

The growth in PAM is also driven by greater awareness of threats targeted privileged accounts. Thycotic says criminals are targeting employees ‘at a higher rate than ever before’.

“Protecting access to privileged credentials, the preferred target of cybercriminals and malicious insiders, is rapidly evolving as a must-have compliance requirement,” Carson continues.

The report analysed areas including PAM policies, processes and controls. It also calls attention to how third party contractors are generally treated as internal employees when it comes to access controls.

“Organisations should ensure that security access controls for vendors or contractors are much more rigorous since they do not have full control over the security behaviours of third parties,” the report states.

Other highlights from the report:

  • 73% of organisations fail to require multi-factor authentication with privileged accounts
  • 64% of organisations fail to fully audit privileged accounts
  • 51% fail to use a secure logon process for privileged accounts
  • 70% of organisations fail to fully discover privileged accounts---and 40% do nothing at all to discover these accounts

Thycotic suggests establishing a lifecycle approach to PAM that flows through the following stages:

1. Understanding the need for PAM among executive and IT staff

2. Identifying privileged accounts across all systems

3. Managing and protecting access to privileged accounts and restricting their use

4. Monitoring privileged account use on a continuous basis

5. Detecting anomalies in privileged account use indicating potential fraudulent activities

6. Responding to privileged account suspected compromise immediately and with targeted actions 7. Review and report to continuously improve PAM access controls.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.