CyberArk Survey Shows Organizations are Failing to Secure Privileged
Accounts and Credentials in the Cloud, on Endpoints and Across IT
Environments
NEWTON, Mass. & PETACH TIKVA, Israel--(BUSINESS WIRE)--Feb. 28, 2018--
According to the CyberArk
Global Advanced Threat Landscape Report 2018, nearly half (46
percent) of IT security professionals rarely change their security
strategy substantially – even after experiencing a cyber attack. This
level of cyber security inertia and failure to learn from past incidents
puts sensitive data, infrastructure and assets at risk.
This press release features multimedia. View the full release here:
http://www.businesswire.com/news/home/20180228005275/en/
The CyberArk Global Advanced Threat Landscape Report 2018 shows organizations are failing to secure privileged accounts and credentials in the cloud, on endpoints and across IT environments. (Graphic: Business Wire)
Security Starts with Protecting Privileged Accounts
An overwhelming number of IT security professionals believe securing an
environment starts with protecting privileged
accounts – 89 percent stated that IT infrastructure and critical
data are not fully protected unless privileged accounts, credentials and
secrets are secured.
Respondents named the greatest cyber security threats they currently
face, including:
-
Targeted phishing attacks (56 percent)
-
Insider threats (51 percent)
-
Ransomware or malware (48 percent)
-
Unsecured privileged accounts (42 percent)
-
Unsecured data stored in the cloud (41 percent)
IT security respondents also indicated that the proportion of users who
have local administrative privileges on their endpoint devices increased
from 62 percent in our 2016 survey to 87 percent in 2018—a 25 percent
jump and perhaps indicative of employee demands for flexibility trumping
security best practices.
The Inertia that Could Lead to Data Compromise
The survey findings suggest that security inertia has infiltrated many
organizations, with an inability to repel or contain cyber threats – and
the risks that this might result in – supported by other findings:
-
46 percent say their organization can't prevent attackers from
breaking into internal networks each time it is attempted
-
36 percent report that administrative credentials were stored in Word
or Excel documents on company PCs
-
Half (50 percent) admit that their customers' privacy or PII
(personally identifiable information) could be at risk because their
data is not secured beyond the legally-required basics
Inertia and a ‘Hands-Off’ Approach to Securing Credentials and Data
in the Cloud Create Cyber Risk
The automated processes inherent in cloud and DevOps
mean privileged accounts, credentials and secrets are being created at a
prolific rate. If compromised, these can give attackers a crucial
jumping-off point to achieve lateral access to sensitive data across
networks, data and applications or to use cloud infrastructure for
illicit crypto mining activities. Organizations increasingly recognize
this security risk, but still have a relaxed approach toward cloud
security. The survey found that:
-
Nearly half (49 percent) of organizations have no privileged account
security strategy for the cloud
-
More than two-thirds (68 percent) defer on cloud security to their
vendor, relying on built-in security capabilities
-
38 percent stated their cloud provider doesn’t deliver adequate
protection
Changing the Security Culture
Overcoming cyber security inertia necessitates it becoming central to
organizational strategy and behavior, not something that is dictated by
competing commercial needs. According to the survey:
-
86 percent of IT security professionals feel security should be a
regular board-level discussion topic
-
44 percent said they recognize or reward employees who help prevent an
IT security breach, increasing to nearly three quarters (74 percent)
in the U.S.
-
Just 8 percent of companies continuously perform Red
Team exercises to uncover critical vulnerabilities and identify
effective responses
“Attackers continue to evolve their tactics, but organizations are faced
with cyber security inertia that is tipping the scales in favor of the
attacker,” said Adam Bosnian, executive vice president, global business
development, CyberArk. “There needs to be a greater urgency in building
cyber security resilience to today’s attacks. This starts by
understanding the expanding privileged account security attack surface
and how it puts an organization at risk. Successfully battling inertia
requires strong leadership, accountability, clearly defined and
communicated security strategies, and the ability to adopt a ‘think like
an attacker’ mindset.”
About the CyberArk Advanced Threat Landscape 2018 Report
The CyberArk Advanced Threat Landscape 2018 annual report is the 11th
in the series. The survey was conducted by Vanson Bourne among 1,300 IT
security decision makers, DevOps and app developer professionals and
line of business owners, across seven countries worldwide.
Additional Resources
About CyberArk
CyberArk
(NASDAQ: CYBR)
is the global leader in privileged account security, a critical layer of
IT security to protect data, infrastructure and assets across the
enterprise, in the cloud and throughout the DevOps pipeline. CyberArk
delivers the industry’s most complete solution to reduce risk created by
privileged credentials and secrets. The company is trusted by the
world’s leading organizations, including more than 50 percent of the
Fortune 100, to protect against external attackers and malicious
insiders. A global company, CyberArk is headquartered in Petach Tikva,
Israel, with U.S. headquarters located in Newton, Mass. The company also
has offices throughout the Americas, EMEA, Asia Pacific and Japan. To
learn more about CyberArk, visit www.cyberark.com,
read the CyberArk
blogs or follow on Twitter via @CyberArk,
LinkedIn
or Facebook.
Copyright © 2018 CyberArk Software. All Rights Reserved. All
other brand names, product names, or trademarks belong to their
respective holders.
View source version on businesswire.com: http://www.businesswire.com/news/home/20180228005275/en/
Source: CyberArk
Media Relations Contacts:
fama PR
Brian Merrill,
+1-617-986-5005
cyberark@famapr.com
or
CyberArk
Liz
Campbell, +1-617-558-2191
press@cyberark.com
or
Investor
Relations Contact:
CyberArk
Erica Smith, +1 617-630-6426
ir@cyberark.com