Member Article

Survey reveals security shortcuts taken by ‘Privileged Users’ during the holidays

BalaBit warns organisations to protect against security lapses during the Festive Season

London, December 10th, 2014 – Results from a Survey with ‘privileged users’*, by BalaBit (www.balabit.com), an IT security innovator specialising in log management and advanced monitoring technologies, reveals that a combination of irresponsible user behaviour and weaknesses in the protection of networks - could create more risks for data breaches during the holiday period than at any other time.

With the festive season approaching, most respondents, (70%) still expect to use the downtime to connect to the network or check in on emails, with more than a third (39%) logging on to access emails several times a day. However, whilst the majority of respondents, 72%, have used their own, a friend’s, colleague’s, or a public device to connect to the network during their holiday, 38% of users have not been asked for extra levels of authentication when connecting to the company network from a device that has not been registered.

The survey also reveals that some executives sidestep basic security measures during their time off. One in seven respondents (14%) have shared personal access details - their user name or password - with a colleague. Going against best practice on password protection, the same number of respondents have shared their password on the phone so that a colleague so could complete an urgent task on their behalf.

Around a third of all respondents surveyed, 35%, also admitted that they have not changed their password immediately after they have given it to someone else. Personal relations appear to play a role in this with a fifth of respondents admitting they had done this, as they trusted that person.

Zoltán GyörkÅ‘ CEO of BalaBit comments: “With the holiday season approaching, it can be a prime time to catch up on any unfinished tasks and many of us need to check in on emails when we’re out of the office. However this survey highlights some worrying lapses in the protection of personal information during holidays. Whilst we’re relaxing at home, we can sometimes use the easiest route to complete a task, which means that security is compromised. Of course, we need to allow executives to do their job even if they’re not in the office, but organisations need to support them to do this in a secure way and which protects the integrity of sensitive company data.”

BalaBit’s Tips to Protect the Network over the Holiday Season Whilst BYOD can help employees to do their job even if they’re not in the office, which can make business processes more effective, IT Security teams should support them to do this in a secure way:

• Establish IT policies to prevent users from sharing account usernames and passwords. Even if a password is changed immediately after it has been shared with any colleague, the security of the corporate network may already have been compromised.
• In situations where a task needs to be done on behalf of a privileged user during the holiday, be prepared in advance. Give temporary access with the appropriate credentials to a colleague who is the ‘substitute’ or use a digital credential store within your network. This solution offers a secure way to store user credentials (for example, passwords, private keys, certificates) to login to the target server, without the user having access to the credentials, even if the credentials belong to shared accounts (e.g. root).
• Ensure that your policies support them to do their job on a secure way, as the time and resources spent on preventing security incidents is far less than that spent on mitigating the risk of business and reputation damages.
• Enforce a secure access (VPN, SSL or bastion mode), and an authentication when users access the company network from a device that is not registered.
• Monitor users’ activities in real time and set alerts (or block the session) in case of detecting suspicious activity in the network. Rather than adding countless control layers, a monitoring-based approach can help to prevent data breaches by identifying unusual user activity.

BalaBit’s Shell Control Box, an industry-leading turnkey appliance for monitoring privileged user’s activities can support the above mentioned recommendations and help organizations to dramatically reduce human risk.

More information is available at: http://www.balabit.com/network-security/scb

This was posted in Bdaily's Members' News section by FE .