The Dangers of Privileged Access
Nearly 80% of all data breaches are the result of compromised privileged credentials. Of the IT leaders that formed that group of respondents, 74% admitted that it was as a result of privileged access credential abuse.
It’s no secret that the threat risk rises as a result of having more users on the network with administrative access; according to the latest Gartner survey, 90% of organisations recognise that the mitigation of privileged access risk is paramount to ongoing security control.
Measures and programs, such as a Privileged Access Management (PAM) or Least Privilege programs, can and are being implemented by some IT leaders, however what is the uptake and what is the best option available to those businesses that do not yet have their counter measures in place?
Overprivileged accounts are a cyber criminal’s best friend, and low hanging fruit. Easily identifiable, the criminal spots an easy point of access to target, without requiring them to put in a great deal of legwork prior. Once the account is accessed, the criminal then has carte blanche to move throughout and across any and all affiliated IT systems and networks, without detection.
One of the primary counter programs utilised by IT leaders today is Least Privilege; it enforces a “Zero Trust” risk-based security model that verifies users and limits their access to only the functions, capabilities and resources needed for that user to accomplish their job.
Familiarity with Least Privilege has risen over the past several years; 94% of IT leaders recognise or use the concept themselves. The rise has been prompted by the influx of cyber risk via phishing campaigns in particular, and GDPR. Article 24 of the legislation mandates that organisations must take reasonable security measures when responding to security and threats – it applies to both the data and requires solutions that restrict access to corporate networks, protecting the identity of users. Article 5 goes hand in hand with this, detailing that personal data processing requires data to be secured from unauthorised access and loss.
A variety of tools can be adopted to adhere to a Least Privilege program. The majority of IT leaders with a strategy already in place utilise privileged access management (PAM) solutions (57%), application control solutions (38%), and anti-virus or anti-malware scanning software (38%). The solution(s) used by organisations do vary, with each depending on size, remoteness of employees and industry defining level of risk and greatest vulnerabilities.
As with many procedures that could potentially impact the day-to-day of an employee and their productivity, there will naturally come challenges. According to a recent study of 250 IT leaders, 22% had difficulties implementing a Least Privilege program – the main reason for which was as a result of complaints from employees (46%). Other reasons include the lack of sponsor from an internal stakeholder (37%), changes in management (34%), the complexity of the PAM needed (32%) and everyone’s favourite: no budget (30%).
We don’t have a budget…we can’t afford it. Can we afford not to?
No budget. When it comes down to this simple but key metric, it is always the battle IT leaders have with their financial departments. The constant and evolving cyber threat risk demands that IT leaders stay one foot in front at all times, however the difficulty comes in portraying hypothetical costs to a CFO as validation. CFOs state they want to see the return on investment in the long run which, while difficult to assemble, can be done in the context of a PAM system.
When planned carefully and comprehensively, and to avoid a reduction in employee productivity and friction, an effective PAM solution can be implemented that will demonstrate its worth and gain executive level support and budget. With 67% of IT decision makers labelling Least Privilege as either a ‘top priority’ or ‘urgent initiative’ over the coming year, it’s clear that the severity and necessity of access controls are coming to light to businesses – in particular when you take into consideration that the global average cost of a data breach is £3 million.
How can a Secure MDM help?
One of the greatest concerns for IT leaders and their reasoning for using a PAM solution is insider threat, including employees, partners and third-party contractors or suppliers. 12% of these leaders say that cloud applications and mobile/remote working devices are at the top of their list to secure when implementing PAM.
Serbus Secure is an integrated and secure suite of tools, designed to protect organisational data, IP and communications. Alongside being an effective and advanced first line of defence against phishing and subsequent scams to gain access to credentials, Serbus Secure centrally manages mobile devices to control security settings, and can remotely lock and wipe data.
Various levels of access to internal networks are monitored securely and receive regular updates and patches.
To learn more about our solutions and how we can assist in keeping your remote workers and organisation’s data, IP and communications safe and secure, get in touch to request a chat on [email protected], or call our office on +44 (0)1432 870 879.