sb-eu logo
Story image

85% of organisations struggling with access management – Thycotic

03 Apr 2019

Privileged access management (PAM) solutions provider Thycotic has announced the release of its 2019 State of PAM Maturity Report.

The report summarises the aggregate data from more than 450 organisations across the globe that participated in Thycotic’s Q4 2018 PAM Maturity Model assessment survey to-date.

According to survey results, while nearly four out of five organisations (78%) now include privileged credential protection as part of their cybersecurity policies, their PAM security practices are woefully lacking and even worse than you might expect.

Eighty-five percent of respondents are still struggling to get beyond the initial phase of PAM maturity.

Among those failing to reach even a basic level of maturity:

  • 55% of organisations have no idea how many privileged accounts they have or where they’re located.
  • More than 50% of organisations’ privileged accounts never expire or get deprovisioned.
  • Only 18% of organisations are storing all their privileged accounts in a secure privileged access management vault or password manager.

“The 2019 State of Privileged Access Management Maturity Report is a wakeup call for organisations worldwide to immediately assess their PAM practices with a goal of moving beyond dangerous habits to implementing a PAM Lifecycle Model, which is outlined in our report,” says Thycotic chief security scientist Joseph Carson. 

Thycotic introduced the free, online PAM Maturity Model assessment survey in Q4 2018 to help organisations determine progress along their journey to lower privileged account risk, increase business agility and improve operational efficiency.

The PAM Maturity assessment consisted of 11 questions that determined how far an organisation has progressed through the four phases of PAM maturity.

As the basis of understanding the results of the PAM Maturity report, the four phases of Thycotic’s PAM Maturity Model assessment consisted of the following:

Phase 1 – Analogue - Organisations in the Analogue phase face a high degree of risk.

Phase 2 – Basic - Organisations transition from Analog to the Basic stage of PAM maturity, by adopting PAM security solutions and automating time-consuming, manual processes. 

Phase 3 – Advanced - Organisations in the Advanced phase of PAM maturity have moved from reactive to a proactive privilege security strategy.

Phase 4 - Adaptive Intelligent - As the ultimate stage of PAM maturity, organisations in the Adaptive/Intelligent phase take continuous improvement to a higher level, integrating leading technologies such as machine learning to collect information and adapt system rules.

“Lack of visibility into how many unprotected privileged accounts exist in an organisation and where they are located is an enormous risk for organisations,” says Carson.

“Because privileged accounts such as local admin and service accounts exist everywhere in multiple places throughout an organisation, trying to manually discover and manage them is virtually impossible.

“The first step of any organisation should be automating privileged account discovery on a continuous basis so that you can see what you need to protect and what security controls should be in place.”

Story image
Why it’s essential to re-write IT security for the cloud era
Key components of network security architecture for the cloud era should be built from the ground up, as opposed to being bolted on to legacy solutions built for organisations functioning only on-premises or from only managed devices.More
Story image
Malware and email scams targeting employees spread rapidly in Q2
"Businesses must stay alert and should employ defense-in-depth tactics and equip themselves with multilayered security mechanisms, including high-sensor spam filters and a VPN connection, which would prevent malicious pages from opening."More
Story image
The guide to digital security in unstable times
An increase in vulnerability across different sectors has meant that 2020 has seen more than its fair share of cybersecurity incidents. One of the most effective ways to combat the perils of today’s cyber-threats is to gain a better knowledge of the threat vectors looming over the heads of organisations. More
Story image
Gartner: By 2023, 65% of the world will have personal data covered under modern privacy regulations
“Security and risk management (SRM) leaders need to help their organisation adapt their personal data handling practices without exposing the business to loss."More
Story image
75% of IT execs 'worried' about being targeted in cyber-attack
A new report from ConnectWise has shed light on the widespread concern about cyber-attacks, with 91% of SMB executives considering a move to an MSP if it provided the 'right' solution.More
Story image
Zero trust is the way to secure the distributed workforce - Empired
Existing security solutions need to evolve to accommodate the new remote workforce.More