Skip to content

Posts tagged ‘Security’

It’s Time To Solve K-12’s Cybersecurity Crisis

It's Time To Solve K-12's Cybersecurity Crisis

  • There were a record 160 publicly-disclosed security incidents in K-12 during the summer months of 2019, exceeding the total number of incidents reported in all of 2018 by 30%.
  • 47% of K-12 organizations are making cybersecurity their primary investment, yet 74% do not use encryption.
  • 93% of K-12 organizations rely on native client/patch management tools that have a 56% failure rate, with 9% of client/patch management failures never recovered.

These and many other fascinating insights are from Absolute’s new research report, Cybersecurity and Education: The State of the Digital District in 2020​, focused on the state of security, staff and student safety, and endpoint device health in K-12 organizations. The study’s findings reflect the crisis the education sector is facing as they grapple with high levels of risk exposure – driven in large part by complex IT environments and a digitally savvy student population – that have made them a prime target for cybercriminals and ransomware attackers. The methodology is based on data from 3.2M devices containing Absolute’s endpoint visibility and control platform, active in 1,200 K-12 organizations in North America (U.S. and Canada). Please see the full report for complete details on the methodology.

Here’ the backdrop:

  • K-12 cybersecurity incidents are skyrocketing, with over 700 reported since 2016 with 160 occurring during the summer of 2019 alone. Educational IT leaders face the challenge of securing increasingly complex IT environments while providing access to a digitally savvy student population capable of bypassing security controls. Schools are now the second-largest pool of ransomware victims, just behind local governments and followed by healthcare organizations. As of today, 49 school districts have been hit by ransomware attacks so far this year.

“Today’s educational IT leaders have been tasked with a remarkable feat: adopting and deploying modern learning platforms, while also ensuring student safety and privacy, and demonstrating ROI on security and technology investments,” said Christy Wyatt, CEO of Absolute.

Research from Absolute found:

K-12 IT leaders are now responsible for collectively managing more than 250 unique OS versions, and 93% are managing up to five versions of common applications. The following key insights from the study reflect how severe K-12’s cybersecurity crisis is today:

  • Digital technologies’ rapid proliferation across school districts has turned into a growth catalyst for K-12’s cybersecurity crisis. 94% of school districts have high-speed internet, and 82% provide students with school-funded devices through one-to-one and similar initiatives. Absolute found that funding for educational technology has increased by 62% in the last three years. The Digital Equity Act goes into effect this year, committing additional federal dollars to bring even more technology to the classroom. K-12 IT leaders face the daunting challenge of having to secure on average 11 device types, 258 unique operating systems versions and over 6,400 unique Chrome OS extensions and more, reflecting the broad scale of today’s K-12 cybersecurity crisis. Google Chromebooks dominate the K-12 device landscape. The following graphic illustrates how rapidly digital technologies are proliferating in K-12 organizations:

  • 42% of K-12 organizations have staff and students regularly bypass security endpoint controls using web proxies and rogue VPN apps, inadvertently creating gateways for malicious outsiders to breach their schools’ networks. Absolute found that there are on average 10.6 devices with web proxy/rogue VPN apps per school and 319 unique web proxy/rogue VPN apps in use today, including “Hide My Ass” and “IP Vanish.”  Many of the rogue VPN apps originate in China, and all of them are designed to evade web filtering and other content controls. With an average of 10.6 devices per school harboring web proxies and rogue VPN apps, schools are also at risk of non-compliance with the Children’s Internet Protection Act (CIPA).

  • While 68% of education IT leaders say that cybersecurity is their top priority, 53% rely on client/patch management tools that are proving ineffective in securing their proliferating IT infrastructures. K-12 IT leaders are relying on client/patch management tools to secure the rapidly proliferating number of devices, operating systems, Chrome extensions, educational apps, and unique application versions. Client/patch management agents fail 56% of the time, however, and 9% never recover. There are on average, nine daily encryption agents’ failures, 44% of which never recover. The cybersecurity strategy of relying on native client/patch management isn’t working, leading to funds being wasted on K-12 security controls that don’t scale:

“Wyatt continued, this is not something that can be achieved by simply spending more money… especially when that money comes from public funds. The questions they each need to be asking are if they have the right foundational security measures in place, and whether the controls they have already invested in are working properly. Without key foundational elements of a strong and resilient security approach in place – things like visibility and control, it becomes nearly impossible to protect your students, your data, and your investments.”

  • Providing greater device visibility and endpoint security controls while enabling applications and devices to be more resilient is a solid first step to solving the K-12 cybersecurity crisis. Thwarting the many breach and ransomware attacks K-12 organizations receive every day needs to start by considering every device as part of the network perimeter. Securing K-12 IT networks to the device level delivers asset management and security visibility that native client/patch management tools lack. Having visibility to the device level also gives K-12 IT administrators and educators insights into how they can tailor learning programs for broader adoption. The greater the visibility, the greater the control. K-12 IT administrators can ensure internet safety policies are being adhered to while setting controls to be alerted of suspicious activity or non-compliant devices, including rogue VPNs or stolen devices. Absolute’s Persistence platform provides a persistent connection to each endpoint in a K-12’s one-to-one program, repairing or replacing critical apps that have been disabled or removed.

You can download the full Absolute report here.

5 Key Insights From Absolute’s 2019 Endpoint Security Trends Report

  • Endpoint security tools are 24% of all IT security spending, and by 2020 global IT security spending will reach $128B according to Morgan Stanley Research.
  • 70% of all breaches still originate at endpoints, despite the increased IT spending on this threat surface, according to IDC.

To better understand the challenges organizations have securing the proliferating number and type of endpoints, Absolute launched and published their 2019 Endpoint Security Trends Report. You can get a copy of the report here. Their findings and conclusions are noteworthy to every organization who is planning and implementing a cybersecurity strategy. Data gathered from over 1B change events on over 6M devices is the basis of the multi-phased methodology. The devices represent data from 12,000 anonymized organizations across North America and Europe. Each device had Absolute’s Endpoint Resilience platform activated. The second phase of the study is based on exploratory interviews with senior executives from Fortune 500 organizations. For additional details on the methodology, please see page 12 of the study.

Key insights from the report include the following:

  1. Increasing security spending on protecting endpoints doesn’t increase an organizations’ safety and in certain cases, reduces it. Organizations are spending more on cybersecurity than ever before, yet they aren’t achieving greater levels of safety and security. Gartner’s latest forecast of global information security and risk management spending is forecast to reach $174.5B in 2022, attaining a five-year Compound Annual Growth Rate (CAGR) of 9.2%. Improving endpoint controls is one of the highest-priority investments driving increased spending. Over 70% of all breaches are still originating at endpoints, despite millions of dollars spent by organizations every year. It’s possible to overspend on endpoint security and reduce its effectiveness, which is a key finding of the study. IBM Security’s most recent Cost of a Data Breach Report 2019 found that the average cost of a data breach in the U.S. grew from $3.54M in 2006 to $8.19M in 2019, a 130% increase in 14 years.
  2. The more complex and layered the endpoint protection, the greater the risk of a breach. One of the fascinating findings from the study is how the greater the number of agents a given endpoint has, the higher the probability it’s going to be breached. Absolute found that a typical device has ten or more endpoint security agents installed, each conflicting with the other. MITRE’S Cybersecurity research practice found there are on average, ten security agents on each device, and over 5,000 common vulnerabilities and exposures (CVEs) found on the top 20 client applications in 2018 alone. Enterprises are using a diverse array of endpoint agents, including encryption, AV/AM, and Endpoint Detection and Response (EDR). The wide array of endpoint solutions make it nearly impossible to standardize a specific test to ensure security and safety without sacrificing speed. Absolute found organizations are validating their endpoint configurations using live deployments that often break and take valuable time to troubleshoot. The following graphic from the study illustrates how endpoint security is driving risk:

  1. Endpoint security controls and their associated agents degrade and lose effectiveness over time. Over 42% of endpoints experience encryption failures, leaving entire networks at risk from a breach. They’re most commonly disabled by users, malfunction or have error conditions or have never been installed correctly in the first place. Absolute found that endpoints often failed due to the fragile nature of their encryption agents’ configurations. 2% of encryption agents fail every week, and over half of all encryption failures occurred within two weeks, fueling a constant 8% rate of decay every 30 days. 100% of all devices experiencing encryption failures within one year. Multiple endpoint security solutions conflict with each other and create more opportunities for breaches than avert them:

  1. One in five endpoint agents will fail every month, jeopardizing the security and safety of IT infrastructure while prolonging security exposures. Absolute found that 19% of endpoints of a typical IT network require at least one client or patch management repair monthly. The patch and client management agents often require repairs as well. 75% of IT teams reported at least two repair events, and 50% reported three or more repair events. Additionally, 5% could be considered inoperable, with 80 or more repair events in the same one-month. Absolute also looked at the impact of families of applications to see how they affected the vulnerability of endpoints and discovered another reason why endpoint security is so difficult to attain with multiple agents. The 20 most common client applications published over 5,000 vulnerabilities in 2018. If every device had only the top ten applications (half), that could result in as many as 55 vulnerabilities per device just from those top ten apps, including browsers, OSs, and publishing tools. The following graphic summarizes the rates of failure for Client/Patch Management Agent Health:

  1. Activating security at the device level creates a persistent connection to every endpoint in a fleet, enabling greater resilience organization-wide. By having a persistent, unbreakable connection to data and devices, organizations can achieve greater visibility and control over every endpoint. Organizations choosing this approach to endpoint security are unlocking the value of their existing hardware and network investments. Most important, they attain resilience across their networks. When an enterprise network has persistence designed to the device level, there’s a constant, unbreakable connection to data and devices that identifies and thwarts breach attempts in real-time.

Bottom Line:  Identifying and thwarting breaches needs to start at the device level by relying on secured, persistent connections that enable endpoints to better detecting vulnerabilities, defending endpoints, and achieve greater resilience overall.

Absolute’s CEO Christy Wyatt On Leading A Cybersecurity Company And The Power Of Resilience

Christy Wyatt’s career exemplifies what you would expect from a high-performing tech leader who thrives on turning challenges into growth. Showing persistence, resiliency, and tenacity – she has a long history of scaling high-growth technology companies and infusing them with greater creative energy, ingenuity, and intensity for results. As CEO of Absolute, she’s leading the company through an evolution that is shifting its focus from simply being known as a ‘track and trace’ company to becoming the world’s most trusted security company delivering endpoint resiliency to businesses of all sizes.

Previously she served as CEO of Dtex Systems, a user behavior intelligence company that grew revenue by 321% last year. Before Dtex, she was Chairman, CEO, and President of Good Technology, the global leader in mobile security where she defined and delivered an aggressive growth strategy before its successful acquisition by BlackBerry. Wyatt began her career as a software engineer and rose through the executive leadership ranks at Citigroup, Motorola, Apple, Palm and Sun Microsystems. She was named one of Inc. Magazine’s Top 50 Women Entrepreneurs in America, CEO of the Year by the Information Security Global Excellence Awards, and one of Fierce Wireless’s Most Influential Women in Wireless.

Insights From Absolute’s Latest Earnings Call

On August 13th, Christy Wyatt and Errol Olsen, CFO of Absolute, hosted the company’s latest earnings call with financial analysts. A transcript of the call is available here. Key insights from the company’s latest quarter and fiscal year-end were shared and included the following:

  • Total revenue in FY19 was $98.9M, representing an increase of 6% over the prior fiscal year with the ACV Base reaching $98M as of June 30, 2019, up $6.5M or 7%, over the prior year.
  • Enterprise sector portion of the ACV Base increased 11% year-over-year. Enterprise customers represented 55% of the ACV Base of June 30, 2019. And the Government sector portion of the ACV Base increased 15% year-over-year, now representing 12% of the ACV Base as of June 30, 2019.
  • Incremental ACV from new customers was $5.2M in FY19, compared to $3.4M in FY18.
  • Adjusted EBITDA in FY19 was $19.3M, or 20% of revenue, up from $9.2M or 10% of revenue, in the prior fiscal year.
  • FY19 Net Income increased 144% over the prior fiscal year based on continued Enterprise market growth.
  • In Q4, Absolute signed a new financial services customer with an ACV just under $1M with their service being delivered by a Managed Service Provider (MSP) that maintains the customers computing infrastructure.
  • Absolute has provided product-level enhancements to make it easier for MSP partners to use their products to support multiple customers, with the strategy paying off with more deals globally.

Christy Wyatt On Competing In Today’s Cybersecurity Industry 

I recently had the opportunity to interview Christy and learn more about how she sees the cybersecurity industry today and where it’s heading, in addition to gaining insights into her and her teams’ goals at Absolute, one of the top 10 cybersecurity companies to watch in 2019. Absolute serves as the industry benchmark for endpoint resilience, visibility, and control. Embedded in over a half-billion devices, the company enables more than 12,000 customers with self-healing endpoint security, always-connected visibility into their devices, data, users, and applications whether endpoints are on or off the corporate network, and the ultimate level of control and confidence required for the modern enterprise.

The following is my interview with Christy:

Louis:             Coming into a new company environment and establishing yourself with credibility in the role is key. What are the things that you’ve gone after immediately to address how the company is doing and where it’s going? In essence, what’s been your 90-day plan, and how’s that going overall?

Christy:          Most incoming CEOs join a company with a thesis about why this is an interesting opportunity and how they can invest significant intellectual capital into it. And then that first 90 days is really about vetting out that model and seeing if the opportunity is real. With Absolute, my thesis was here is a company that very few people understood, with an amazing install base and partner community built around unique self-healing capabilities. If you juxtapose that against the security industry today, you’ll see the glaringly huge problem. There are start-ups after start-ups all claiming they can protect businesses from breaches – so organizations keep buying more and more technology – all while breaches are accelerating. And those businesses keep asking themselves, “Are we more secure? How do I know if my business is more secure?” And the answer is they don’t know.

When I talk to customers, they say, “I have more than ten agents on every laptop in my device fleet. User experience is suffering, and the complexity is mind boggling.” As a CEO, I want to be able to fix that, right? How do we effectively deploy security controls in a way that is healthy and productive for both the laptop and for the user? That’s a massive opportunity, and that’s what gets me excited about Absolute.

Louis:             In your last few earnings calls, you referenced wins in financial services, healthcare, and professional services. What do you attribute the success of Absolute moving more towards the enterprise?

Christy:          The initial transition and increased focus on the enterprise market predates me. Over the past year, however, we’ve expanded our discussions into all the sectors you mention, and more, to better understand what they’re doing around enterprise resilience.

In April, we published original research that examined the state of decay and exposure points around endpoint security. Once we quantified that, we then spent our time with customers talking about what’s happening within their unique environments. What we found was that they had a false sense of security. They have encryption, malware security, and VPN all checked. But based on our research and new analytics, we were able to show them there are gaps in their protection when those agents became un-installed, missed a patch, or conflicted with other controls. That is the rate of decay we are talking about. How to make their existing controls more resilient to decay. We highlighted how their existing deployments degrade, weaken and fail over time. We also showed them some simple strategies to heal and even boost the immune system of their environment. That’s very powerful, and as a result, customers are leaning into our resilience story – it helps them capture the value of the investments they have already made.

Louis:             Regarding your product roadmap and the direction you’re going in, what are some of the plans that you’re looking to be able to capitalize on that presence that you have on billions of devices?

Christy:          Critical to our success has always been our partners. If you look at our Resilience product, which is our enterprise product, we can heal other third-party applications. So if the average enterprise has ten plus security agents deployed, there are probably at least three to five that they care about. They say, “Look, I feel exposed from a compliance perspective or a risk perspective if I don’t have, for example, encryption turned on… and it’s not okay with me that my users can delete something or turn it off.” Our data tells us where and how we can serve, and better secure, those enterprise IT architectures.

There’s a growing list of things within our platform today that we already heal. Broadening our resilience capabilities is something you’re going to see us invest significantly in. And then there’s work we have to do for our customers’ security and IT organizations, pointing them to the specific, critical things that need their focus right now. So if there’s a gap or something has gone offline in their security fabric, I want to bring their attention to it; I want to heal it and fix it. Absolute excels at solving those challenges for our customers.

Louis:             You mention endpoints often, and it makes me think about ‘Zero Trust’ security and the proliferation of IoT and industrial internet of things devices and how that’s flourishing across manufacturing and other distributed based industries like supply chains. What are your long term plans in these areas?

Christy:          We’re doing a lot of work in that space. With 5G quickly evolving, this is going to have a significant impact on the enterprise, and the ability to have similar controls on anything that’s connected to your network will be critical. I think there is a lot of credence in Zero Trust model as one of the many security architectures, but any one of these has to be rooted in something. So even if you’re trying to manage security from the cloud, your efficiency and your effectiveness are only as good as the data that you’re getting. If you don’t have visibility on what’s connected or what’s happening on the endpoint, your ability to diagnose it or fix it is relatively is impacted. My view is whatever you think your security strategy is today, the controls you think you need are going to be completely different 18 months from now. And so the five things you care about persisting and healing today are not going to be the same five things you care about in that timeframe. Our job is leverage our BIOS enabled foundation that allows enterprises to get reliable data, see the things that are protecting their environment, and heal them if something goes wrong – regardless of what their stack looks like.

Louis:             So Absolute becomes a system of record because it is the definitive record of all activity coming off of that laptop or that device that’s enabled at the BIOS level with your technology.

Christy:          I think we’re a big part of that. We’ve talked to a lot of customers, and there are other visibility solutions on the market. A lot of times somebody says, “Well, I have a fill-in-the-blank-security-product, and so I think I see everything.” My answer is the thing they are relying on is likely one of those ten things that are sitting in the stack that has a rate of decay – because it is not rooted in the BIOS so, therefore, it has some inherent vulnerability. So we should be instrumenting that and ensuring that we protect that critical control, ensure it is always running, and heal it if it goes offline. Our customers rely on us because they know that we are giving them the complete picture.

I don’t see the vast ecosystem of security products as competitive to what we are doing. I see those as complementary. Whatever is in your security technology stack, let’s make sure it’s always there, let’s make sure it’s always turned on, and let’s heal it if it goes offline.

Louis:             Regarding the designed-in win you’ve achieved with being embedded at the BIOS level, do you spend time OEMs? How is that all orchestrated at the platform level, or at the OEM level, to ensure that you continue to have that as a competitive advantage?

Christy:          We’ve had very close relationships with our OEM partners for well over a decade. We spend a lot of time looking at both the technical architectures and customer challenges. Every one of our OEM partners has a unique strategy for how they are delivering unique security services to their customers, and we view ourselves as an enabler of those strategies.

Louis:             When you visit customers, what are they most excited about? What’s their burning need right now? What are they focused on?

Christy:          Right now, we’re spending a lot of time with our customers focused on simplifying their experience and making these new capabilities easier to use, and easier to integrate into their environments. A lot of our customers have been with us for a long time and get very excited about how we make their jobs easier with more automation using things like our constantly expanding library of Reach scripts, enabling their IT teams to automate a lot of their endpoint tasks.

Where we also see a significant change in behavior is when we show them the power of some of our Resilience capabilities, paired with some of our analytics pieces. When we show them the state of the endpoint as it applies to their unique environment, where the gaps are, and demonstrate how we can help heal those gaps, I often hear, “Oh, I didn’t know Absolute could do that…” It’s a big departure from where we were ten years ago. So I think we’re going through a period of reintroducing ourselves to our customers and showing them that, even with the technology they already have, they could be doing so much more.

Louis:             How do you build the business case for Absolute?

Christy:          I think it depends on the customer. I think that if they’re a customer that’s talking to us about our visibility and control products, which are really about trust in our BIOS level visibility and control, management and tracking and locating and taking fine grain view at their assets, then I think the conversation is really about return on investment around the asset itself. Using their data to give them valuable insights about the state of their assets, as well as their posture. It’s a conversation about protecting the investment you’re making in your computing infrastructure.

When we’re talking to a customer about resiliency, it’s really about how much they are spending on security and how do we help them get back the return on investment of the dollars they’ve already spent. I believe the frenzy around security spending has put a lot of IT managers into a position where they have deep stacks and are not getting the full return on investment from those controls. We want to help them close the gap.

Louis:             How do you enable innovation of culture and be able to turn out the next generation products?

Christy:          So, I’ve done it a bunch of different ways, and I believe that what is most empowering to people who love to build great products….is when individuals get to see their stuff, their unique idea, their new concept go to market and be used by customers. We are fundamentally builders using our tools to solve customer problems.

What I like is a little bit more of the startup energy. Where people can bring forward ideas, and if we agree this is a cool idea – we invest.  We give them a team and a timeline. We can give those ideas an opportunity for commercialization. And by the way, that’s what engineers and innovators and entrepreneurs love the most. That’s what they want. They get passionate about pointing to a product and saying, “I did that. That’s super cool. It was my idea; they gave me a team. I learned a lot, and I got to have an impact.” And I think that impact is really what fires or fuels the innovation culture.

How To Secure Mobile Devices In A Zero Trust World

  • 86% of enterprises are seeing mobile threats growing the fastest this year, outpacing other threat types.
  • 48% say they’ve sacrificed security to “get the job done” up from 32% last year.
  • 41% of those affected say the compromise is having major with lasting repercussions and 43% said that their efforts to remediate the attacks were “difficult and expensive.”

Bottom Line: The majority of enterprises, 67%, are the least confident in the security of their mobile assets than any other device or platform today according to Verizon’s Mobile Security Index 2019.

Why Mobile Devices Are the Fastest Growing Threat Surface Today     

Verizon found that 86% of enterprises see an upswing in the number, scale, and scope of mobile breach attempts in 2019. When broken out by industry, Financial Services, Professional Services, and Education are the most commonly targeted industries as the graphic below shows:

The threat surfaces every organization needs to protect is exponentially increasing today based on the combination of employee- and company-owned mobile devices. 41% of enterprises rate mobile devices as their most vulnerable threat surface this year:

Passwords and Mobile Devices Have Become A Hacker’s Paradise

“The only people who love usernames and passwords are hackers,” said Alex Simons, corporate vice president at Microsoft’s identity division in a recent Wall Street Journal article, Username and Password Hell: Why the Internet Can’t Keep You Logged In. Verizon found that mobile devices are the most vulnerable, fastest-growing threat surface there is, making it a favorite with state-sponsored and organized crime syndicates. How rapidly mobile devices are proliferating in enterprises today frequently outpace their ability to secure them, falling back on legacy Privileged Access Management (PAM) approaches that hacking syndicates know how to get around easily using compromised passwords and privileged access credentials. Here’s proof of how much of a lucrative paradise it is for hackers to target passwords and mobile devices first:

  • Hacker’s favorite way to gain access to any business is by using privileged access credentials, which are increasingly being harvested from cellphones using malware. Hacking organizations would rather walk in the front door of any organizations’ systems rather than expend the time and effort to hack in. It’s by far the most popular approach with hackers, with 74% of IT decision makers whose organizations have been breached in the past say it involved privileged access credential abuse according to a recent Centrify survey, Privileged Access Management in the Modern Threatscape. Only 48% of the organizations have a password vault, and just 21% have multi-factor authentication (MFA) implemented for privileged administrative access. The Verizon study found that malware is the most common strategy hackers use to gain access to corporate networks. MobileIron’s Global Threat Report, mid-year 2018 found that 3.5% of Android devices are harboring known malware. Of these malicious apps, over 80% had access to internal networks and were scanning nearby ports. This suggests that the malware was part of a larger attack.

Securing Mobile Devices In A Zero Trust World Needs To Happen Now

Mobile devices are an integral part of everyone’s identity today. They are also the fastest growing threat surface for every business – making identities the new security perimeter. Passwords are proving to be problematic in scaling fast enough to protect these threat surfaces, as credential abuse is skyrocketing today. They’re perennial best-sellers on the Dark Web, where buyers and sellers negotiate in bitcoin for companies’ logins and passwords – often with specific financial firms, called out by name in “credentials wanted” ads. Organizations are waking up to the value of taking a Zero Trust approach to securing their businesses, which is a great start. Passwords are still the most widely relied-on security mechanism – and continue to be the weakest link in today’s enterprise security.  That needs to change. According to the Wall Street Journal, the World Wide Web Consortium has recently ratified a standard called WebAuthN, which allows websites to authenticate users with biometric information, or physical objects like security keys, and skip passwords altogether.

MobileIron is also taking a unique approach to this challenge by introducing zero sign-on (ZSO), built on the company’s unified endpoint management (UEM) platform and powered by the MobileIron Access solution. “By making mobile devices your identity, we create a world free from the constant pains of password recovery and the threat of data breaches due to easily compromised credentials,” wrote Simon Biddiscombe, MobileIron’s President and Chief Executive Officer in his recent blog post, Single sign-on is still one sign-on too many. Simon’s latest post MobileIron: We’re making history by making passwords history, provides the company’s vision going forward with ZSO. Zero sign-on eliminates passwords as the primary method for user authentication, unlike single sign-on, which still requires at least one username and password. MobileIron paved the way for a zero sign-on enterprise with its Access product in 2017, which enabled zero sign-on to cloud services on managed devices.

Conclusion

Mobile devices are the most quickly proliferating threat surface there are today and an integral part of everyone’s identities as well. Thwarting the many breach attempts attempted daily over mobile devices and across all threat surfaces needs to start with a solid Zero Trust framework. MobileIron’s introduction of zero sign-on (ZSO) eliminates passwords as the method for user authentication, replacing single sign-on, which still requires at least one username and password. ZSO is exactly what enterprises need to secure the proliferating number of mobile devices they rely on to operate and grow in a Zero Trust world.

74% Of Data Breaches Start With Privileged Credential Abuse

Centrify’s survey shows organizations are granting too much trust and privilege, opening themselves up to potential internal and externally-driven breaches initiated with compromised privileged access credentials. Photo credit: iStock

Enterprises who are prioritizing privileged credential security are creating a formidable competitive advantage over their peers, ensuring operations won’t be interrupted by a breach. However, there’s a widening gap between those businesses protected from a breach and the many who aren’t. In quantifying this gap consider the typical U.S.-based enterprise will lose on average $7.91M from a breach, nearly double the global average of $3.68M according to IBM’s 2018 Data Breach Study.

Further insights into how wide this gap is are revealed in Centrify’s Privileged Access Management in the Modern Threatscape survey results published today. The study is noteworthy as it illustrates how wide the gap is between enterprises’ ability to avert and thwart breaches versus their current levels of Privileged Access Management (PAM) and privileged credential security. 74% of IT decision makers surveyed whose organizations have been breached in the past, say it involved privileged access credential abuse, yet just 48% have a password vault, just 21% have multi-factor authentication (MFA) implemented for privileged administrative access, and 65% are sharing root or privileged access to systems and data at least somewhat often.

Addressing these three areas with a Zero Trust approach to PAM would make an immediate difference in security.

“What’s alarming is that the survey reveals many organizations, armed with the knowledge that they have been breached before, are doing too little to secure privileged access. IT teams need to be taking their Privileged Access Management much more seriously, and prioritizing basic PAM strategies like vaults and MFA while reducing shared passwords,” remarked Tim Steinkopf, Centrify CEO. FINN Partners, on behalf of Centrify, surveyed 1,000 IT decision makers (500 in the U.S. and 500 in the U.K.) online in October 2018. Please see the study here for more on the methodology.

How You Choose To Secure Privileged Credentials Determines Your Future 

Identities are the new security perimeter. Threats can emerge within and outside any organization, at any time. Bad actors, or those who want to breach a system for financial gain or to harm a business, aren’t just outside. 18% of healthcare employees are willing to sell confidential data to unauthorized parties for as little as $500 to $1,000, and 24% of employees know of someone who has sold privileged credentials to outsiders, according to a recent Accenture survey.

Attackers are increasingly logging in using weak, stolen, or otherwise compromised credentials. Centrify’s survey underscores how the majority of organizations’ IT departments have room for improvement when it comes to protecting privileged access credentials, which are the ‘keys to the kingdom.’ Reading the survey makes one realize that forward-thinking enterprises who are prioritizing privileged credential security gain major cost and time advantages over their competitors. They’re able to keep their momentum going across every area of their business by not having to recover from breaches or incur millions of dollars on losses or fines as the result of a breach.

One of the most promising approaches to securing every privileged identity and threat space within and outside an organization is Zero Trust Privilege (ZTP). ZTP enables an organizations’ IT team to grant least privilege access based on verifying who is requesting access, the context of the request, and the risk of the access environment.

Key Lessons Learned from the Centrify Survey

How wide the gap is between organizations who see identities as the new security perimeter and are adopting a Zero Trust approach to securing them and those that aren’t is reflected in the results of Centrify’s Privileged Access Management in the Modern Threatscape surveyThe following are the key lessons learned of where and how organizations can begin to close the security gaps they have that leave them vulnerable to privileged credential abuse and many other potential threats:

  • Organizations’ most technologically advanced areas that are essential for future growth and attainment of strategic goals are often the most unprotected. Big Data, cloud, containers and network devices are the most important areas of any IT infrastructure. According to Centrify’s survey, they are the most unprotected as well. 72% of organizations aren’t securing containers with privileged access controls. 68% are not securing network devices like hubs, switches, and routers with privileged access controls. 58% are not securing Big Data projects with privileged access controls. 45% are not securing public and private cloud workloads with privileged access controls. The study finds that UK-based businesses lag U.S.-based ones in each of these areas as the graphic below shows:

  • Only 36% of U.K. organizations are very confident in their company’s current IT security software strategies, compared to 65% in the U.S. The gap between organizations with hardened security strategies that have a higher probability of withstanding breach attempts is wide between U.K. and U.S.-based businesses. 44% of U.K. respondents weren’t positive about what Privileged Access Management is, versus 26% of U.S. respondents. 60% of U.K. respondents don’t have a password vault.

  • Just 35% of U.S. organizations and 30% of those in the UK are relying on Privileged Access Management to manage partners’ access to privileged credentials and infrastructure. Partners are indispensable for scaling any new business strategy and expanding an existing one across new markets and countries. Forward-thinking organizations look at every partner associates’ identity as a new security perimeter. The 35% of U.S.-based organizations doing this have an immediate competitive advantage over the 65% who aren’t. By enforcing PAM across their alliances and partnerships, organizations can achieve uninterrupted growth by eliminating expensive and time-consuming breaches that many businesses never fully recover from.
  • Organizations’ top five security projects for 2019 include protecting cloud data, preventing data leakage, analyzing security incidents, improving security education/awareness and encrypting data. These top five security projects could be achieved at scale by having IT teams implement a Zero Trust-based approach to Privileged Access Management (PAM). The time, cost and scale advantages of getting the top five security projects done using Zero Trust would free up IT teams to focus on projects that deliver direct revenue gains for example.

Conclusion

Centrify’s survey shows organizations are granting too much trust and privilege, opening themselves up to potential internal and externally-driven breaches initiated with compromised privileged access credentials. It also reveals that there is a strong desire to adhere to best practices when it comes to PAM (51% of respondents) and that the reason it is not being adequately implemented rarely has to do with prioritization or difficulty but rather budget constraints and executive buy-in.

The survey also shows U.K. – and U.S.-based organizations need to realize identity is the new security perimeter. For example, only 37% of respondents’ organizations are able to turn off privileged access for an employee who leaves the company within one day, leaving a wide-open exposure point that can continue to be exploited.

There are forward-thinking organizations who are relying on Zero Trust Privilege as a core part of their digital transformation efforts as well. The survey found that given a choice, respondents are most likely to say digital transformation (40%) is one of the top 3 projects they’d prefer to work on, followed by Endpoint Security (37%) and Privileged Access Management (28%). Many enterprises see digital transformation’s missing link being Zero Trust and the foundation for redefining their businesses by defining every identity as a new security perimeter, so they can securely scale and grow faster than before.

%d bloggers like this: