Privilege abuse widespread among infosecurity professionals

Almost 65 percent of security professionals surveyed at the recent RSA conference admit to accessing documents that have nothing to do with their jobs.

The study by risk analytics specialist Gurucul also reveals that nearly one in five (19 percent) of respondents admit to having abused their privileged access to view sensitive data. That number increases to 36 percent among those who've had a poor job performance review.

In addition 38 percent of respondents send company documents to their personal email, and 47 percent of security professionals have clicked on a link in an email they received from someone they didn't know.

"We knew insider privilege abuse was rampant in most enterprises, but these survey results demonstrate that the infosecurity department is not immune to this practice," says Saryu Nayyar, CEO of Gurucul. "Detecting impermissible access to resources by authorized users, whether it is malicious or not, is virtually impossible with traditional monitoring tools. That's why many organizations are turning to security and risk analytics that look at both employee and entity behaviors to identify anomalies indicative of insider threats."

Among other findings are that in healthcare 33 percent have abused their privileged access, while in manufacturing, 78 percent accessed documents unrelated to their jobs. In the retail sector, 86 percent have clicked on a link in an email from someone they didn't know.

Also in mid-sized companies, 62 percent didn't alert IT when their job role had changed. 20 percent of IT security professionals admit to having voiced their frustrations with work on social media too.

The report highlights the problems organizations have with employees behaving outside of the bounds of practical and published security policies. The human element is often the deciding factor in how data breaches occur.

The full report is available from the Gurucul site.

Image Credit: jamdesign / depositphotos.com