courion survey findings: access risk attitudes
DESCRIPTION
Call it the great Data Breach Disconnect. A recent survey of IT security executives revealed the gap between knowing about access risk and an organization’s ability to remediate that risk. For example, 97% of respondents are aware that access risk is created by misused or stolen credentials, but only 29% are confident that their organization is able to detect improper access.TRANSCRIPT
![Page 1: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/1.jpg)
Conducted by Courion in November 2014Audience of 35,400 IT security executives
at companies worldwide with 500+ employees
![Page 2: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/2.jpg)
After a year of unrelenting data breaches, IT security executives are
keenly aware of the possibility of a breach within their organizations . .
.
![Page 3: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/3.jpg)
84% agree: it is not whether you will be breached, but rather,
what you can do to reduce the damage of a breach
Agree84%
Disagree16%
![Page 4: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/4.jpg)
43% know someone whose organization has suffered a
data breach in the last 6 months
Yes43%
No57%
![Page 5: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/5.jpg)
![Page 6: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/6.jpg)
97% agree: misused or stolen access credentials
provide easy access for hackers
Agree97%
Disagree3%
![Page 7: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/7.jpg)
The majority are confident that they have access under control .
. .
![Page 8: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/8.jpg)
76% believe their organization knows who has
administrative privileges
Agree76%
Disagree24%
![Page 9: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/9.jpg)
And 72% said their organization enforces a “least privilege”
policy
Agree72%
Disagree28%
![Page 10: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/10.jpg)
But below the surface there may be a disconnect . . .
![Page 11: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/11.jpg)
43% admit their organization does not know when
access privileges are increased, or when access behavior
changes
Aware57%
Not Aware43%
![Page 12: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/12.jpg)
And only 29% feel confident their organization is able to detect
when access credentials are misused or stolen
I do not know29%
Agree29%
Disagree42%
![Page 13: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/13.jpg)
Will these organizations be able to deter or detect a breach?
![Page 14: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/14.jpg)
41% know abandoned accounts exist in their organization,
and another 12% just don’t know . . .
Disagree47%
Agree41%
I do not know12%
![Page 15: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/15.jpg)
And only 47% feel confident there are no
orphaned accounts in their organization
Agree47%
Disagree41%
I do not know12%
![Page 16: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/16.jpg)
In fact, privileged accounts & unnecessary entitlements
are the access risks that cause the most anxiety
10.4%
11.9%
31.1%
46.7%
0.0% 5.0% 10.0% 15.0% 20.0% 25.0% 30.0% 35.0% 40.0% 45.0% 50.0%
ORPHANED ACCOUNTS - accounts with noadminstrative oversight
ABANDONED ACCOUNTS - accounts inactive for a timeperiod exceeding policy
UNNECESSARY ENTITLEMENTS - unneeded or excessaccess privileges, often in conflict with SoD practices
PRIVILEGED ACCOUNTS - accounts with increasedlevels of permission that provide elevated access to
critical networks, systems, applications or transactions
![Page 17: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/17.jpg)
So how can IT security get ahead of access risks?
![Page 18: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/18.jpg)
By using an identity and access intelligence solution that
continuously monitors access risks . . .
![Page 19: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/19.jpg)
So you can quickly view accounts by privileged entitlements
![Page 20: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/20.jpg)
And identify and eliminate abandoned accounts
![Page 21: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/21.jpg)
And find orphan accounts that need administrative oversight
![Page 22: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/22.jpg)
And maintain a least privilege policy
![Page 23: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/23.jpg)
The Department of Homeland Security recommends
improved access hygiene & continuous access monitoring
Conduct a regular review of employee access and terminate any account
that individuals do not need to perform their daily job responsibilities.
Terminate all accounts associated with an employee or contractor immediately
upon dismissal.
Change administrative passwords to servers and networks following
the release of IT personnel.
Avoid using shared usernames and passwords for remote desktop protocol.
Do not use the same login and password for multiple platforms, servers, or networks.
Ensure third party service companies providing e-mail or customer support
know that an employee has been terminated.
Restrict Internet access on corporate computers to cloud storage Web sites.
Do not allow employees to download unauthorized remote login applications
on corporate computers.
Maintain daily backups of all computer networks and servers.
Require employees change passwords to corporate accounts regularly
(in many instances, default passwords are provided by IT staff and are never changed).
http://www.ic3.gov/media/2014/140923.aspx
![Page 24: Courion Survey Findings: Access Risk Attitudes](https://reader034.vdocuments.site/reader034/viewer/2022052400/559b0e541a28aba2638b479f/html5/thumbnails/24.jpg)
To learn more about how you can add intelligence to
your identity & access management, contact
866.COURION.