Attacks/Breaches
3/6/2014
05:06 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

New IT Security Survey Results -- Top Reasons To Monitor Users

BalaBit IT Security survey about use of privileged identity management (PIM) and privileged activity monitoring (PAM) technology

NEW YORK and SAN FRANCISCO, February 25, 2014 – BalaBit IT Security (www.balabit.com) today announced results of a recent survey of IT security professionals about use of privileged identity management (PIM) and privileged activity monitoring (PAM) technology.

Of those surveyed, respondents ranked the reasons for monitoring privileged users, from most to least important, as follows:

1. Detect/track suspicious user behavior and prevent incidents – 60% considered this the most important factor

2. Control and audit IT service providers

3. Control and audit internal IT staff

4. Support IT/network staff in troubleshooting

5. Support internal business processes (i.e., reporting)

6. Meet/prove compliance with regulatory requirements

7. Control and audit virtual desktop infrastructure (VDI) users

8. Reduce costs for IT operations

9. Support forensics investigations

10. Reduce costs for security audits

"With compliance as the sixth most important reason for companies to deploy PIM, it is reassuring to see that most companies recognize it is more important to increase their operational efficiency by increasing the security level and managing people than only 'checking the box' and passing the audits," said Zoltán Györkő, CEO of BalaBit IT Security.

Altough 98% of respondents said that a PAM tool could increase the level of protection to their system security, a relatively high number of 16% stated that they have no solution deployed at all to protect against malicious insiders.

"It's disturbing that so many decision-makers are still ignoring the human factor and making their procurement priorities based on the physical and virtual infrastructure. The most commonly used product, firewalls, are completely ineffective against handcrafted attacks, especially APT or internal attacks. It is clear from today's headlines that these types of attacks are happening with much more frequency and are not only a common source of data breaches but the primary source of the most costly cyber attacks," said Györkő.

Additional survey findings include:

Those who have any kind of tools against internal attacks use at least two different products at the same time to provide the required protection Although almost all companies have been using firewalls, only 63% of the interviewed said that they use firewall options such as access policies to prevent internal cyber-attacks

37% use identity/password management

30% use network access control (NAC)

Activitity monitoring is performed by 25% of the companies

Almost two-thirds would prefer to have a standalone, turnkey appliance for PAM purposes

About the Survey

BalaBit IT Security conducted this survey between September 2013 and January 2014 by interviewing more than 400 IT professionals including CIOs, CSOs, system administrators, system managers and other IT workers in Europe (mainly in France, Germany, UK and Hungary). 44% of respondents work for large, 34% for middle size, 22% for small size companies. They represented industries including IT and telecom (38 percent), government (26 percent), financial (16 percent), retail (7 percent), manufacturer (5 percent) and healthcare (3 percent) sectors.

About BalaBit

BalaBit IT Security is an innovative information security company, a global leader in the development of privileged activity monitoring, trusted logging and proxy-based gateway technologies to help protect customers against internal and external threats and meet security and compliance regulations. As an active member of the open source community, we provide solutions to a uniquely wide range of both open source and proprietary platforms, even for the most complex and heterogeneous IT systems across physical, virtual and cloud environments.

BalaBit is also known as "the syslog-ng company", based on the company's flagship product, the open source log server application, which is used by more than 1 million companies worldwide and became the globally acknowledged de-facto industry standard.

For more information, visit www.balabit.com.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4231
Published: 2015-07-03
The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.

CVE-2015-4232
Published: 2015-07-03
Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

CVE-2015-4234
Published: 2015-07-03
Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.

CVE-2015-4237
Published: 2015-07-03
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv0...

CVE-2015-4239
Published: 2015-07-03
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report