Survey Reveals Widespread Mismanagement of Privileged Accounts and Access

Nine in 10 IT security professionals feel challenged with managing privileged passwords and access, according to results of a new global survey of IT security professionals conducted by Dimension Research for One Identity.

Dimensional Research surveyed 913 IT security professionals on challenges, habits, and trends related to managing access to corporate data and found that 88 percent of respondents admit to facing challenges when it comes to managing privileged passwords. Additionally, one in five (18 percent) still use a paper-based logbook to manage privileged accounts.

Privileged accounts grant virtually unlimited access to nearly every component of a company’s IT infrastructure, essentially handing over the keys to a company’s most critical and sensitive systems and data. The survey also exposed three key areas where distressingly inferior practices for privileged account management occur, including:

In addition to 18 percent of respondents admitting to using paper-based logs, 36 percent are using spreadsheets to track privileged accounts. The survey also found that two-thirds (67 percent) of companies are relying on two or more tools to manage these accounts — indicating widespread inconsistency in privileged access management (PAM).

The majority of IT security professionals (57 percent) admit to only monitoring some privileged accounts, or not monitoring privileged access at all. Even worse, 21 percent of respondents confessed they are unable to monitor or record activity performed with admin credentials, while 32 percent said they cannot consistently identify individuals who perform admin activities.

An overwhelming 86 percent of organizations are not consistently changing the password on their admin accounts after each use. Further, 40 percent of IT security professionals don’t take the basic best practice of changing a default admin password. By not adhering to these best practices, privileged accounts are vulnerable to open the door to data exfiltration or worse, if compromised.

“When an organization doesn’t implement the very basic processes for security and management around privileged accounts, they are exposing themselves to significant risk. Over and over again, breaches from hacked privileged accounts have resulted in astronomical mitigation costs, as well as data theft and tarnished brands,” said John Milburn, president and general manager of One Identity. “These survey results indicate that there are an alarmingly high percentage of companies that don’t have proper procedures in place. It is crucial for organizations to implement best practices regarding privileged access management without creating new roadblocks for work to get done.”