sb-eu logo
Story image

Widespread mismanagement of privileged accounts and access revealed in global survey

17 Nov 2017

Identity and access management (IAM) company One Identity has released new global research that exposes widespread poor practices when it comes to managing privileged accounts.

Dimensional Research recently surveyed 913 IT security professionals on challenges, habits and trends related to managing access to corporate data.

Among the most eye-opening research findings are that eight in 10 (80%) of Australian respondents admit to facing challenges when it comes to managing privileged passwords, and nearly one in five (17%) still use a paper-based logbook to manage privileged accounts in Australia.

These findings are significant considering that privileged accounts grant virtually unlimited access to nearly every component of a company’s IT infrastructure, essentially handing over the keys to a company’s most critical and sensitive systems and data.

The survey also exposed three key areas where distressingly inferior practices for privileged account management occur, including:

●        Management platforms and tools: In addition to 17% of Australian respondents admitting to using paper-based logs, a surprising 34 percent are using equally inadequate spreadsheets for tracking privileged accounts. The survey also found that two-thirds (67%) of companies are relying on two or more tools to manage these accounts -- indicating widespread inconsistency in privileged access management (PAM).

●        Monitoring and visibility: The majority of Australian IT security professionals (71%) admit to only monitoring some privileged accounts, or not monitoring privileged access at all. Even worse, 22% of Australian respondents confessed they are unable to monitor or record activity performed with admin credentials, while 34% said they cannot consistently identify individuals who perform admin activities.

●        Password management and change: Globally, an overwhelming 86% of organizations are not consistently changing the password on their admin accounts after each use. Further, 40% of IT security professionals don’t take the basic best practice of changing a default admin password. By not adhering to these best practices, privileged accounts are vulnerable to open the door to data exfiltration or worse, if compromised.

“Without taking the very basic but essential steps in employing security and management in regard to privileged accounts, organizations are putting themselves at risk to exposing valuable information. By not implementing vital security methods companies continue to put themselves at risk to breaches that will not only have financial implications, but legal implications once the mandatory breach notification legislation comes into play next year,” says Richard Cookes, One Identity ANZ country manager.

“On top of this, companies can also face data theft and irreversible damage to organizational reputations.”

“This survey indicates quite an alarmingly high percentage of IT professionals don’t have proper security practices in place. These findings show how crucial it is for organizations to reassess and implement strong security procedures regarding privileged access management.” The One Identity Global State of IAM Study consisted of an online survey conducted by Dimensional Research of IT professionals with responsibility for IT security as a major part of their job and were very knowledgeable about IAM.

A wide variety of questions were asked about experiences and challenges with IAM. A total of 913 individuals from the US, Canada, UK, Germany, France, Australia, Singapore and Hong Kong completed the survey.

This report is based on the global study, and One Identity offers a free online executive summary of the data in a Key Findings Report, as well as an illustrated look at the data in an infographic. 

Story image
Proofpoint enhances security awareness training platform
Available in Q4 2020, the platform will integrate more closely with Proofpoint’s best-in-class threat intelligence.More
Story image
Is cyber deception the latest SOC 'game changer'?
Cyber deception reduces data breach costs by more than 51% and Security Operations Centre (SOC) inefficiencies by 32%, according to a new research report by Attivo Networks and Kevin Fiscus of Deceptive Defense.More
Story image
COVID-19 related email threats pose huge risk in 2020
According to the company’s annual mid-year roundup report, Trend Micro blocked 8.8 million COVID-19 related threats, nearly 92% of which were email-based.More
Story image
Ripple20 threat has potential for 'vast exploitation', ExtraHop researchers find
One in three IT environments are vulnerable to a cyber threat known as Ripple20. This is according to a new report from ExtraHop, a cloud-native network detection and response solutions provider. More
Story image
Revealed: The behaviours exhibited by the most effective CISOs
As cyber-threats pile up, more is being asked of CISOs - and according to Gartner, only a precious few are 'excelling' by the standards of their CISO Effectiveness Index.More
Story image
Kaspersky finds red tape biggest barrier against cybersecurity initiatives
The most common obstacles that inhibit or delay the implementation of industrial cybersecurity projects include the inability to stop production (34%), and bureaucratic steps, such as a lengthy approval process (31%) and having too many decision-makers (23%). More