The Schwartz Report

Blog archive

Most Organizations Still Lack Adequate Identity Management Controls

An overwhelming number of organizations appear to lack mature best practices when it comes to addressing identity and access management to their systems, making them more vulnerable to breaches, according to 203 IT decision makers surveyed by Forrester Consulting.

Results of the survey, commissioned by IAM provider Centrify, were shared this week at the RSA Conference in San Francisco. Centrify CEO Tom Kemp shared the findings Monday during the Cloud Security Alliance event. A report based on the survey's findings determined that the least mature organizations experienced twice the number of breaches as the most mature ones.

That's not to say those who have adequately addressed authentication are immune to breaches -- they reported 5.7 annual incidents, while those with lacking identity and access management policies reported an average of 12.5 incidents per year. Across the board, two thirds said they have experienced five or more breaches during the past two years, with misuse of identities and passwords the key causes.

Nevertheless, most IT and information security managers aren't ignoring authentication and identity management, Corey Williams, senior director of product management at Centrify, acknowledged. "It's a more piecemeal approach. They do a few tactical things but not looking at things holistically," Williams said. The Forrester report emphasized issues stemming from privileged access as a common cause of breaches.

During the RSA Conference, Centrify polled another 100 security managers, which found 68 percent enforce single sign-on and 43 percent have multi-factor authentication implemented in their organization. Only 36 percent responded that they don't allow sharing of their privileged accounts, with 13 percent not allowing session recording, 12 percent implementing granular deprovisioning of access across server and application accounts and only 8 percent having privilege elevation management.

Posted by Jeffrey Schwartz on 02/17/2017 at 12:02 PM


Featured

  • Vendors Issue Patches for Linux Container Runtime Flaw Enabling Host Attacks

    This week, the National Institute of Standards and Technology (NIST) described a high-risk security vulnerability (CVE-2019-5736) for organizations using containers that could lead to compromised host systems.

  • Windows 10 Version 1809 Users May Get Visual Studio Crashes

    Microsoft on Friday issued an advisory for Windows 10 version 1809 users about possible Visual Studio crashes.

  • Standardizing the Look of Outlook's Outbound Messages

    Microsoft typically gives users a blank canvas to compose new e-mails in Outlook. In some corporate environments, however, a blank canvas isn't a good thing.

  • Windows 10 'Semiannual Channel Targeted' Goes Away This Spring

    Microsoft plans to slightly alter its Windows servicing lingo and management behavior with its next Windows 10 operating system feature update release, coming this spring.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.