Analytics
10/22/2013
04:33 PM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

BeyondTrust Survey Reveals Privileged Users Are Out Of Control

Latest survey findings illustrate that insider threats continue to be a serious threat vector for organizations

San Diego, CA, October 22, 2013 – BeyondTrust, the security industry's only provider of Context-Aware Security Intelligence, today announced the results of its recently concluded survey, Privilege Gone Wild that reveals employees are granted excessive privileges and access for their particular roles resulting in unnecessary risks to organizations. In its entirety, the survey highlights the significant industry challenge associated with proper identity and privilege management.

One of the most startling statistics from this survey reveals that 28% of respondents admitted to having retrieved information not relevant to their job. When asked what information was accessed, nearly one-quarter identified financial reports and almost half provided written responses specifying salary details, HR data and personnel documents, etc. To illustrate just how serious of an issue this is for organizations, one IT employee at a large, well-known critical infrastructure provider admitted to having retrieved financial reports while another IT employee at well well-known professional services firm admitted to retrieving R&D plans, neither of which was relevant to their jobs.

The survey also revealed two-thirds have controls in place to monitor privilege access yet 54% of those respondents stated that they could circumvent those controls. This statistic illustrates that while current solutions are in place to detect privileged abuse, they're easily defeated by the average end user.

"Allowing any employee unfettered access to non-essential company data is both unnecessary and dangerous and should be an issue that is resolved quickly," said Brad Hibbert, EVP of product strategy at BeyondTrust. "The insider threat has always been a vulnerability we take very seriously at BeyondTrust and it's our goal to help customers combat this growing problem."

Additional key survey takeaways:

44% of employees have access rights that are not necessary to their current role

80% of respondents believe that it's at least somewhat likely that employees access sensitive or confidential data out of curiosity

Over three-quarters of respondents say the risk to their organization caused by the insecurity of privileged users will increase over the next few years

Customer information is considered most likely at risk if there's a lack of proper access controls over privileged users

To read more findings from the Privilege Gone Wild survey, please visit: http://www.beyondtrust.com/Content/images/Privilege-Gone-Wild.jpg

The survey reflects responses from 265 IT decision makers including security managers, and network and systems engineers across a number of industries including financial services, manufacturing, and government, among others.

About BeyondTrust

BeyondTrust is the only security solution vendor providing Context-Aware Security Intelligence, giving customers the visibility and controls necessary to reduce their IT security risks, while at the same time simplifying their compliance reporting.

BeyondTrust offers consistent policy-driven vulnerability and privilege management, role-based access control, monitoring, logging, auditing and reporting to protect internal assets from the inside out. The company's products empower IT governance to strengthen security, improve productivity, drive compliance, and reduce expense across physical, virtual, mobile and cloud environments.

With more than 25 years of global success, BeyondTrust is the pioneer of both Threat Management and Privileged Identity Management (PIM) solutions for heterogeneous IT environments. More than half of the companies listed on the Dow Jones Industrial Average rely on BeyondTrust to secure their enterprises. Customers include eight of the world's 10 largest banks, eight of the world's 10 largest aerospace and defense firms, and 7 of the 10 largest U.S. pharmaceutical companies, as well as renowned universities across the globe.

Follow BeyondTrust

Twitter: http://twitter.com/beyondtrust

Blog: http://blog.beyondtrust.com

LinkedIn: http://www.linkedin.com/companies/beyondtrust

Facebook: http://www.facebook.com/beyondtrust

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Peter Fretty
50%
50%
Peter Fretty,
User Rank: Apprentice
11/14/2013 | 3:46:04 PM
re: BeyondTrust Survey Reveals Privileged Users Are Out Of Control
Interesting. Spotlights the need for better granular controls afforded IT by implementing next gen firewalls (i.e. Sophos UTM). There is already enough of an external threat considering the evolving nature of attackers...organizations should not have to worry about what privileged users are doing.

Peter Fretty
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-0889
Published: 2014-07-29
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote atta...

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3020
Published: 2014-07-29
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

Best of the Web
Dark Reading Radio