Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

10/8/2019
04:16 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Sila and Ponemon Institute Study Finds Rampant Lapses in Securing Access to Sensitive Information

Joint Research Finds Major Challenges Monitoring and Managing Privileged User Access and Activities, with 70 Percent of Respondents Indicating Users Likely to Access Sensitive or Confidential Data Without a Business Need

Arlington, VA – October 8, 2019 – Sila Solutions Group, a North American technology and management consulting firm, in partnership with the Ponemon Institute, a leading research organization on data protection and emerging information technologies, today released the results of The 2019 Study on Privileged Access Security. The primary takeaway from this study is that insufficient privileged access management (PAM) practices continue to be a critical challenge for many organizations despite significant risks of data breaches and security incidents. According to more than 650 North American respondents, 70 percent think it likely that privileged users within their organizations are accessing sensitive or confidential data for no discernible business need and more than half expect privilege user abuse to increase in next 12-24 months.

Interestingly, the primary reason users have unnecessary access to sensitive resources is that all users at their level are given privileged access, even if it is not required to perform their job assignment. According to respondents, privileged access rights also regularly remain active even after a role change (30 percent). 62 percent of participants felt it likely that their organization assigns privileged access rights that go beyond an individual’s role or responsibilities. This proliferation of access is emphasized with more than 75 percent of respondents having privileged access to three or more IT resources.

According to study participants, the biggest challenges organizations face in granting and enforcing privileged user access rights are:

57 percent – Can’t keep pace with the number of access change requests that come in on a regular basis

48 percent – Lack of a consistent approval process for access and a way to handle exceptions

43 percent – Burdensome process for business users requesting access

“The results of The 2019 Study on Privileged Access Security shed light on the fact that privileged access is more prevalent than people may realize. It touches every part of an organization and has far-reaching implications for an organization’s business objectives as well as its security,” said Tapan Shah, managing director at Sila. “Leaders need to step back and ask why individuals have the access they do, and how that aligns with the mission of their business – unnecessary privileged access puts data, employees, customers, and the overall business at risk.” 

Additional key findings from the report state:

52 percent of organizations do not believe they have the capabilities to effectively monitor privileged user activities

60 percent are not confident that their organization has enterprise-wide visibility for privileged user access or can determine if these users are compliant with policies

Why? 45 percent of those with low confidence state that they can’t create a unified view of privileged access across the enterprise and 29 percent say they can’t keep up with the changes occurring to the organization’s IT resources

Over 70 percent of respondents believe that greater automation of access management processes would be the biggest benefit to their organization’s overall identity and access management security posture 

On Tuesday, October 29th at 1:00pm ET, Sila and the Ponemon Institute will provide a deep dive on the survey findings while sharing insights and best practices on PAM. Please see here to register for the webinar. 

“With organizations facing a multitude of threats on a daily basis and as the risks related to PAM continue getting worse, this year’s survey shows that overall progress toward effective PAM implementation continues to stagnate in many areas,” said Dr. Larry Ponemon of the Ponemon Institute. “The status quo is not secure. Business and IT leaders need to look beyond simple tool integration and a “check the box” mentality solely driven by compliance demands. Organizations take a big risk by not properly investing in effective PAM strategies that not only promote security, but propel business success.”  

 

Supporting Resources:

Download the Full Report

Download Report Graphics

View Executive Summary

Register for the Webinar

 

About Sila

Sila is a technology and management consulting firm that provides substantial solutions in the areas of identity and access management, data analytics, cybersecurity and risk, software engineering and integration, strategy and transformation, and digital and creative services. Our clients include Fortune 500 companies and Federal government agencies.

 

Sila is headquartered in Arlington, VA, with offices in Seattle, WA; Shelton, CT; and Chicago, IL. For more information visit www.silasg.com. 

 

Follow Sila at:

Twitter: @sila_insights

LinkedIn

YouTube

Facebook 

 

 

 

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20399
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVE-2020-7915
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
CVE-2019-20391
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20392
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20393
PUBLISHED: 2020-01-22
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.