Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/8/2017
03:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Widespread Mismanagement of Privileged Accounts and Access Revealed in One Identity Global Survey

Nine in 10 respondents (88 percent) admit to challenges managing privileged passwords

ALISO VIEJO, CA -- (November 7, 2017) -- One Identity, a proven leader in helping organizations get identity and access management (IAM) right, today released new global research that exposes widespread poor practices when it comes to managing privileged accounts. Dimensional Research recently surveyed 913 IT security professionals on challenges, habits and trends related to managing access to corporate data. Among the most eye-opening research findings are that nine in 10 (88 percent) respondents admit to facing challenges when it comes to managing privileged passwords, and one in five (18 percent) still use a paper-based logbook to manage privileged accounts.

These findings are significant considering that privileged accounts grant virtually unlimited access to nearly every component of a company’s IT infrastructure, essentially handing over the keys to a company’s most critical and sensitive systems and data. The survey also exposed three key areas where distressingly inferior practices for privileged account management occur, including:

  • Management platforms and tools: In addition to 18 percent of respondents admitting to using paper-based logs, a surprising 36 percent are using equally inadequate spreadsheets for tracking privileged accounts. The survey also found that two-thirds (67 percent) of companies are relying on two or more tools to manage these accounts -- indicating widespread inconsistency in privileged access management (PAM).
  • Monitoring and visibility: The majority of IT security professionals (57 percent) admit to only monitoring some privileged accounts, or not monitoring privileged access at all. Even worse, 21 percent of respondents confessed they are unable to monitor or record activity performed with admin credentials, while 32 percent said they cannot consistently identify individuals who perform admin activities.

 

  • Password management and change: An overwhelming 86 percent of organizations are not consistently changing the password on their admin accounts after each use. Further, 40 percent of IT security professionals don’t take the basic best practice of changing a default admin password. By not adhering to these best practices, privileged accounts are vulnerable to open the door to data exfiltration or worse, if compromised.

“When an organization doesn’t implement the very basic processes for security and management around privileged accounts, they are exposing themselves to significant risk. Over and over again, breaches from hacked privileged accounts have resulted in astronomical mitigation costs, as well as data theft and tarnished brands,” said John Milburn, president and general manager of One Identity. “These survey results indicate that there are an alarmingly high percentage of companies that don’t have proper procedures in place. It is crucial for organizations to implement best practices regarding privileged access management without creating new roadblocks for work to get done.”

 

Avoiding Primitive Management
A recent Forrester Report states that eight out of 10 breaches that occur involve privileged credentials, highlighting just how much of a target privileged accounts are for hackers. Cybercriminals know that gaining access to privileged accounts is the easiest and fastest way to obtain a company’s critical data and systems, which is why organizations can no longer rely on old practices, such as paper records or Excel logbooks, to manage these priority accounts.

One Identity understands that when it comes to managing and monitoring these privileged accounts, continuously controlling access and governing credentials and administrators is challenging. One Identity Safeguard secures and automates the management of privileged or shared accounts for both on-prem and cloud based accounts using a modern architecture that is easy to deploy, operate and maintain. This enables organizations to secure their privileged accounts without the added complexity and friction of traditional PAM solutions.

About the One Identity Global State of IAM Study
The One Identity Global State of IAM Study consisted of an online survey conducted by Dimensional Research of IT professionals with responsibility for IT security as a major part of their job and were very knowledgeable about IAM. A wide variety of questions were asked about experiences and challenges with IAM. A total of 913 individuals from the U.S., Canada, U.K., Germany, France, Australia, Singapore and Hong Kong completed the survey.

This report is based on the global study, and One Identity offers a free online executive summary of the data in a Key Findings Report, as well as an illustrated look at the data in an infographic. These materials can be found here.

About One Identity

One Identity, a Quest Software business, helps organizations get identity and access management (IAM) right. With a unique combination of offerings including a portfolio of identity governance, access management and privileged management, and identity as a service that help organizations reach their full potential, unimpeded by security yet safeguarded against threats. One Identity has proven to be a company unequalled in its commitment to its customers' long-term IAM success. More than 7,500 customers worldwide depend on One Identity solutions to manage more than 125 million identities, enhancing their agility and efficiency while securing access to their data -- wherever it might reside. For more information, visit http://www.oneidentity.com.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cloud Security Threats for 2021
Or Azarzar, CTO & Co-Founder of Lightspin,  12/3/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27772
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could po...
CVE-2020-27773
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to appli...
CVE-2020-28950
PUBLISHED: 2020-12-04
The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
CVE-2020-27774
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but co...
CVE-2020-27775
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but c...