Analytics
10/22/2013
04:33 PM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

BeyondTrust Survey Reveals Privileged Users Are Out Of Control

Latest survey findings illustrate that insider threats continue to be a serious threat vector for organizations

San Diego, CA, October 22, 2013 – BeyondTrust, the security industry's only provider of Context-Aware Security Intelligence, today announced the results of its recently concluded survey, Privilege Gone Wild that reveals employees are granted excessive privileges and access for their particular roles resulting in unnecessary risks to organizations. In its entirety, the survey highlights the significant industry challenge associated with proper identity and privilege management.

One of the most startling statistics from this survey reveals that 28% of respondents admitted to having retrieved information not relevant to their job. When asked what information was accessed, nearly one-quarter identified financial reports and almost half provided written responses specifying salary details, HR data and personnel documents, etc. To illustrate just how serious of an issue this is for organizations, one IT employee at a large, well-known critical infrastructure provider admitted to having retrieved financial reports while another IT employee at well well-known professional services firm admitted to retrieving R&D plans, neither of which was relevant to their jobs.

The survey also revealed two-thirds have controls in place to monitor privilege access yet 54% of those respondents stated that they could circumvent those controls. This statistic illustrates that while current solutions are in place to detect privileged abuse, they're easily defeated by the average end user.

"Allowing any employee unfettered access to non-essential company data is both unnecessary and dangerous and should be an issue that is resolved quickly," said Brad Hibbert, EVP of product strategy at BeyondTrust. "The insider threat has always been a vulnerability we take very seriously at BeyondTrust and it's our goal to help customers combat this growing problem."

Additional key survey takeaways:

44% of employees have access rights that are not necessary to their current role

80% of respondents believe that it's at least somewhat likely that employees access sensitive or confidential data out of curiosity

Over three-quarters of respondents say the risk to their organization caused by the insecurity of privileged users will increase over the next few years

Customer information is considered most likely at risk if there's a lack of proper access controls over privileged users

To read more findings from the Privilege Gone Wild survey, please visit: http://www.beyondtrust.com/Content/images/Privilege-Gone-Wild.jpg

The survey reflects responses from 265 IT decision makers including security managers, and network and systems engineers across a number of industries including financial services, manufacturing, and government, among others.

About BeyondTrust

BeyondTrust is the only security solution vendor providing Context-Aware Security Intelligence, giving customers the visibility and controls necessary to reduce their IT security risks, while at the same time simplifying their compliance reporting.

BeyondTrust offers consistent policy-driven vulnerability and privilege management, role-based access control, monitoring, logging, auditing and reporting to protect internal assets from the inside out. The company's products empower IT governance to strengthen security, improve productivity, drive compliance, and reduce expense across physical, virtual, mobile and cloud environments.

With more than 25 years of global success, BeyondTrust is the pioneer of both Threat Management and Privileged Identity Management (PIM) solutions for heterogeneous IT environments. More than half of the companies listed on the Dow Jones Industrial Average rely on BeyondTrust to secure their enterprises. Customers include eight of the world's 10 largest banks, eight of the world's 10 largest aerospace and defense firms, and 7 of the 10 largest U.S. pharmaceutical companies, as well as renowned universities across the globe.

Follow BeyondTrust

Twitter: http://twitter.com/beyondtrust

Blog: http://blog.beyondtrust.com

LinkedIn: http://www.linkedin.com/companies/beyondtrust

Facebook: http://www.facebook.com/beyondtrust

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Peter Fretty
50%
50%
Peter Fretty,
User Rank: Apprentice
11/14/2013 | 3:46:04 PM
re: BeyondTrust Survey Reveals Privileged Users Are Out Of Control
Interesting. Spotlights the need for better granular controls afforded IT by implementing next gen firewalls (i.e. Sophos UTM). There is already enough of an external threat considering the evolving nature of attackers...organizations should not have to worry about what privileged users are doing.

Peter Fretty
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.