Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/11/2015
09:40 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Privileged Account Control Still Weak In Most Organizations

Two studies this week show there's a long way to go in securing credentials for risky accounts.

A pair of studies out this week illustrate how privileged account management remains the bane of infosecurity programs, as most enterprises still struggle to control these accounts in spite of the risk they pose.

The risk is significant, according to a study by CyberArk  that analyzed dozens of enterprise networks and found that 88% are significantly susceptible to attacks through privileged credentials theft and abuse. In about 40% of the cases, simple Windows hosts offer attackers all the credentials they need for a complete network takeover.

Meanwhile, a survey of IT security leaders conducted by Dimensional Research on behalf of Dell found that most understand the importance of managing privileged accounts. One in four believe better control over these accounts would reduce their likelihood for breach. And 80% of respondents say they do at least have a defined process for managing them. The problem is that in many instances that process is pretty unreliable.

For example, just about one in three of these respondents say that management process is tracking these accounts using Excel or other spreadsheets. Additionally, 37% of respondents report that default admin passwords on hardware and software are not consistently changed; and the same ratio of respondents report that multiple administrators share credentials.


"Privileged accounts really are the 'keys to the kingdom,' which is why hackers seek them out and why we've seen so many high-profile breaches over the past few years use these critical credentials," says John Milburn, executive director and general manager of identity and access management for Dell Security.

This jibes with other statistics released elsewhere this year. For example, the Verizon Data Breach Investigations Report found that one in five security incidents is caused by privileged account misuse. Meanwhile, anecdotal evidence supports the evidence that these accounts are an Achilles heel of enterprise-class organizations. For example, the massive breach at the Office of Personnel Management earlier this year could be attributed to weaknesses in privileged account management at the agency and its associated contractors.

"With credentials for a privileged account, an attacker can gain complete control over the host or hosts that accept those credentials," the CyberArk report said. "This allows the attacker not only to access and breach all the sensitive data on those hosts,
 but also to perform other malicious actions such as installing malware and disabling or reconfiguring security controls."

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This gives a new meaning to blind leading the blind.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21441
PUBLISHED: 2021-06-16
There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any user intraction. This issue affects: OTRS A...
CVE-2020-9493
PUBLISHED: 2021-06-16
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
CVE-2021-28815
PUBLISHED: 2021-06-16
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link vers...
CVE-2021-3535
PUBLISHED: 2021-06-16
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. ...
CVE-2021-32685
PUBLISHED: 2021-06-16
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-5...