Survey Reveals InfoSec is Doing it all Wrong!
While, “doing it all wrong” may be an exaggeration, no one can deny the fact that breaches are on the rise, and IT security solutions seem to be falling behind the attack curve. Yet, those looking to place blame may need only look in the mirror. At least that what a survey from cyber security vendor BeyondTrust is indicating.
BeyondTrust surveyed Over 500 senior IT, IS, legal and compliance experts about their privileged access management practices. The survey revealed some interesting trends, some of which should fall under the banner of “they should know better”. For example, only 14 percent regularly cycle their passwords, meaning that 86 percent of those surveyed are avoiding one of the top best practices for password and credential management. Adding insult to injury, only 3 percent of those surveyed monitor systems in real-time and have the capability to terminate a live session that may be indicative of a breach.
Simply put, the survey indicates that the majority of organizations need to do much more to protect systems from breaches. Many of which, could be easily avoided if the proper policies are put into effect. That said, the survey also revealed that 52 percent of respondents are not doing enough about known risks. In other words, they understand what the risks are, but have not deployed the technologies or crafted the policies to mitigate those risks.
Mitigating those risks should be one of the top jobs of InfoSec today, especially since most of the identified risks can be quickly resolved, using off the shelf products and by just applying best practices. BeyondTrust has developed some recommendations that InfoSec professionals can take to heart to lower risk and harden systems from breaches.
Those recommendations include:
Be granular: Implement granular least privilege policies to balance security with productivity. Elevate applications, not users.
Know the risk: Use vulnerability assessments to achieve a holistic view of privileged security. Never elevate an application’s privileges without knowing if there are known vulnerabilities.
Augment technology with process: Reinforce enterprise password hygiene with policy and an overall solution. As the first line of defense, establish a policy that requires regular password rotation and centralizes the credential management process.
Take immediate action: Improve real-time monitoring of privileged sessions. Real-time monitoring and termination capabilities are vital to mitigating a data breach as it happens, rather than simply investigating after the incident.
Close the gap: Integrate solutions across deployments to reduce cost and complexity, and improve results. Avoid point products that don’t scale. Look for broad solutions that span multiple environments and integrate with other security systems, leaving fewer gaps.
In an interview with GigaOM, Kevin Hickey, President and CEO at BeyondTrust, offered “Companies that employ best practices and use practical solutions to restrict access and monitor conditions are far better equipped to handle today’s threat landscape.”
Hickey added “The survey proved critical for helping BeyondTrust to better identify threats based upon privilege management, and also helped us evolve our product offerings to make privilege management a much easier process for security professionals.”
Hickey’s statements were validated by the launch of some new product offerings, which are aimed at bringing privilege management ease to those charged with IT security. The two new offerings are the BeyondTrust Managed Service Provider (MSP) Program and an Amazon Machine Image (AMI) of BeyondInsight available on the Amazon Marketplace. Those products are geared to prevent breaches that involve privileged credentials with deployments that include on premise solutions, virtual device solutions, as well as in the Cloud or from a Managed Services Provider.
Image copyright Via Reddit.
More From paidContent.org
