Insider threat as prime security concern

Cyber-Ark Software revealed the findings of its annual “Trust, Security and Passwords” report. Whilst the research reveals a growing awareness of external threats among respondents, it is clear that everyday security issues are the main concerns occupying the IT department’s time at present – with 74 percent of respondents believing the insider threat to be greater than the external.

Awareness of privilege connections is growing, but organizations are failing to monitor privileged activities

The report demonstrated that organizations are making the link between high profile cyber attacks and the exploitation of privileged account access. These privileged access points consist of privileged and administrative accounts, default and hardcoded passwords, application backdoors, and more. These accounts act as a gateway to an organization’s most sensitive data, which is accessible across systems, applications and servers.

63 percent agree that recent security attacks have involved the exploitation of privileged account access. The report also revealed that privileged activities are not always being monitored.

It was also found that half of the respondents could get around the controls put in place to monitor their privileged access, revealing serious shortcomings in the approaches that many organizations are taking to manage privilege.

Despite the lack of appropriate, or any, monitoring of privilege, the report did show that organizations are making a link between high profile cyber attacks and privileged access. Furthermore, such headline-grabbing incidents have led almost half of organizations to rethink their security strategies.

Privilege widely abused

Findings also indicate that while organizations continue to fail to monitor privileged accounts, employees are taking advantage and are abusing their powers.

• 48 percent of respondents across EMEA would take company information with them in some form if they were told they were going to be fired tomorrow; with privileged password lists (9 percent) and the customer database (8 percent) the most likely information to be taken
• Despite this, 86 percent thought that they did not have the right to take any information when they left a company or were no longer employed by an organization
• 42 percent of respondents, or their colleagues, have used an admin password to access information that was otherwise confidential or sensitive
• 53 percent suspect that their competitors have received some of their company’s highly sensitive information or intellectual property.