Survey: Companies can't cope with privileged access

The issue is vital for cybersecurity because privileged users are extremely valuable to attackers.

Most companies continue to struggle with managing privileged-user access to their IT networks and few managers are satisfied with the degree of visibility and control they have over the privilege granting process, according to newly published survey data.

The problems have grown worse over the past five years and show few signs of improvement, according to the data, released Tuesday by the Ponemon Institute and Forcepoint, a joint venture of Raytheon and Vista Equity Partners.

“It’s very challenging with the interdependencies between today’s interconnected systems, for both business management and IT management, to understand exactly what access is required” for each employee, Forcepoint’s Senior Manager for Insider Threat Operations Dan Velez told Cyberscoop.

Around 700 IT professionals in the U.S. responded to surveys in 2011, 2014 and 2016, the report said. For the purposes of the study, Ponemon defines privileged users to include database administrators, network engineers, IT security practitioners and cloud custodians.

The issue is vital for cybersecurity because privileged users are the most useful vectors for hackers looking to steal credentials or the most dangerous form of insider threats. A single pilfered credential from a database administrator, for instance, enabled the massive Anthem hack.

“Step one in cybersecurity risk management is understanding what the [organization’s] critical assets are and who has access to them,” said Velez.

But the survey shows that most companies cannot keep up with the administrative demands of managing privileged user accounts.

Over the past five years, the proportion of respondents who say they “cannot keep pace with the number of access change requests that come in on a regular basis,” has risen from just over half (53 percent) to nearly two-thirds (61 percent).

The number saying that it “takes too long to deliver access to privileged users” has risen from a third (32 percent) to nearly half (47 percent).

Thirty-nine percent of respondents said they weren’t confident that they have the visibility they need into privileged user access to determine if users are complying with company policies. Only 18 percent are very confident that they have this visibility.

On the plus side, there was a very slight drop (from 35 to 32 percent) over the five years in the number saying their company lacks “a consistent approval process for access and a way to handle exceptions.” And a larger fall (52 to 41 percent) in the number saying it was “difficult to audit and validate privileged user access changes.”

“Privileged users are very challenging to manage,” said Velez, and the reports states that they “often use their rights inappropriately and put their organizations’ sensitive information at risk.”

For example, three-quarters (74 percent) of respondents agreed with the statement that “privileged users believe they are empowered to access all the information they can view;” while two-thirds (66 percent) agreed that they access “sensitive or confidential data” out of “curiosity.”

This article has been corrected to accurately reflect the status of Forcepoint as a joint venture of Raytheon and Vista Equity Partners.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure