The hidden security risk of privileged users

All businesses are aware of the danger posed by insider threats, but those threats are multiplied when they involve privileged user accounts.

Damage caused by privileged users is the most extensive, the hardest to mitigate and the hardest to detect as it involves authorized users doing things they are authorized to do. A new report from access management specialist Forcepoint in conjunction with the Ponemon Institute looks at the gap between organizations' awareness of the problem and their ability to solve it.

The study conducted among more than 700 operations and IT security managers finds that 91 percent think that the insider threat will continue to grow or stay the same. Yet only 15 percent of respondents say they have a dedicated budget to address this significant challenge.

According to 79 percent of respondents, privileged access rights are required to complete their current job assignments. However, many respondents have more access than they need, 21 percent say they do not need privileged access to do their jobs but have it anyway. There are two main reasons given for this. First, everyone at the same job level has privileged access even if it isn't required to perform a job (43 percent). Second, the organization has failed to revoke rights when a role changed and no longer needed access privileges (34 percent).

Only 43 percent of organizations say they have the capability to effectively monitor privileged user activities. In addition 58 percent pointed out that organizations are unnecessarily assigning access to individuals that go beyond their role or responsibilities.

The fear of attack using privileged credentials is high too. 46 percent believe that malicious insiders would use social engineering to obtain a privileged users access rights -- up 20 percent from a similar survey in 2011.

"The best approach to mitigating privileged user abuse is a comprehensive and layered approach that implements best practices, incorporates process and technology and most importantly, addresses the people behind the permissions," says Forcepoint's technical director of insider threat solutions, Michael Crouse. "Damage caused by privileged users is the most extensive, the hardest to mitigate and the most difficult to detect, as it is done by authorized users doing things they are authorized to do. This report underscores the enormous gap between organizations' awareness of the problem and their ability to solve it".

The full study is available to download from the Forcepoint website and there's a summary of the findings in infographic form below.

Photo credit: Olivier Le Moal / Shutterstock