![\"Five](\"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/07\/IAM-CEO-mod.jpg\")
<\/p>\n<\/p>\n
What are five lessons from privileged access management experts in the wake of 2019 data breaches?\u00a0<\/span><\/p>\n Throughout 2019, enterprises learned the hard way about the necessity of privileged access management to prevent data breaches. Indeed, privileged access solution provider <\/span>Centrify<\/span><\/a> found 74% of data breaches begin with a compromised privileged account.<\/span><\/p>\n However, enterprises continue to neglect their privileged access management even as the data breaches pile up. Centrify found 52% of enterprises don\u2019t have a password vault and 65% still share their privileged access. Moreover, 21% still don\u2019t use multifactor authentication. Regardless if this stems from neglect or ignorance, this must change.\u00a0\u00a0<\/span><\/p>\n If any of this applies to your enterprise, you need a wake-up call. Here are five lessons from privileged access management experts to help you in 2019 and beyond.\u00a0\u00a0<\/span><\/p>\n We reported on the Quest Diagnostics Breach on <\/span><\/i>June 4, 2019<\/span><\/i><\/a>. These comments come from Dana Tamir, Vice President of Market Strategy at <\/span><\/i>Silverfort<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n \u201cToday, more than ever, hackers are exploiting weak and stolen credentials to gain unauthorized access to sensitive systems and data. The best way to prevent unauthorized access is by enforcing multi-factor authentication (MFA); Requiring users to authenticate with a 2nd factor (via a mobile app, smart card, one-time-passwords, etc) ensures that only authorized users can access sensitive systems. Yet most of our sensitive systems still rely on password-only authentication mechanisms, which can be easily bypassed.\u201d<\/span><\/p>\n We reported on the Chipotle Credential Stuffing Attack on <\/span><\/i>April 18, 2019<\/span><\/i><\/a>. We here quote Adam Laub, SVP of Product Management at <\/span><\/i>STEALTHbits Technologies<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n \u201cWhile password reuse across sites is what makes credential stuffing attacks so successful, credential stuffing isn\u2019t the only weapon in an attacker\u2019s arsenal. The use of weak, default, or stolen passwords period is enough to make an account vulnerable, especially with alternative techniques like Password Spraying. With Password Spraying, an attacker can try a small number of highly common passwords against large numbers of accounts while also staying below lockout thresholds, compromising accounts without any elevated privileges and likely without detection.\u201d<\/span><\/p>\n With so little information, it\u2019s hard to say for sure if additional techniques are in play. But the point is that just like there\u2019s more than one way to build your burrito bowl, there\u2019s (way) more than one way to compromise your account.\u201d<\/span><\/p>\n We reported on the VFEmail Incident on <\/span><\/i>February 12, 2019<\/span><\/i><\/a>. These comments come from Fausto Oliveira, Principal Security Architect at <\/span><\/i>Acceptto<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cThe fact that attackers were able to access and erase all the information demonstrates that the systems were not protected in an effective way. Critical systems, such as these that host customer data, must be protected with enhanced security and all operations must be protected using intelligent Multi-Factor Authentication solutions. If those controls were in place, an operation that deviates from trusted behavior would have raised the friction towards the attackers and provide immutable logs showing that the attack was in progress, allowing VFEmail to react quickly and potentially stop the breach before data was destroyed.\u201d\u00a0\u00a0<\/span><\/p>\n We reported on the State Farm Credential Stuffing Attack on <\/span><\/i>August 9, 2019<\/span><\/i><\/a>. <\/span><\/i>These expert opinions come from Vinay Sridhara, Chief Technical Officer at <\/span>Balbix<\/span><\/a>. <\/span>\u00a0<\/span><\/i><\/p>\n \u201cCredential stuffing attacks are becoming a frequent threat as companies such as PCM, Sky and Dunkin\u2019 Donuts have all learned this year. The fact is that the credential stuffing attacks are just one attack vector companies must be prepared to defend against. Organizations are tasked with the cumbersome burden of continuously monitoring all assets across hundreds of potential attack vectors to detect vulnerabilities.\u00a0<\/span><\/p>\n This involves analyzing tens of billions of time-varying data signals, a task that is not a human-scale problem anymore. The key to thwarting future attacks like what State Farm has suffered is to leverage security tools that employ AI and ML to observe and analyze these data points in real-time and derive insights to prioritize which vulnerabilities to fix first, based on risk and business criticality. Proactively managing risk must become the new norm.\u201d<\/span><\/p>\n We reported on the MoviePass Data Exposure on <\/span><\/i>August 21, 2019<\/span><\/i><\/a>. Here, we quote Robert Prigge, President of <\/span><\/i>Jumio<\/span><\/i><\/a>.\u00a0<\/span><\/i><\/p>\n \u201cWhat\u2019s also clear is that KBA (knowledge-based authentication), which relies on the notion of shared secrets, should be heavily scrutinized as a reliable means of authentication.\u00a0<\/span><\/p>\n Why? Given that more and more of our supposed shared secrets are now available for pennies on the dark web, the job of the fraudster\u2014especially those focused on account takeovers\u2014just got a little bit easier.\u201d<\/span><\/p>\n Thanks to our privileged access management experts for their time and expertise! To learn more, be sure to check our 2019 Privileged Access Management Buyer\u2019s Guide; you can also download our 2019 Identity Management Buyer\u2019s Guide. We cover the top solution providers in both markets and their key capabilities. Also, we provide a Bottom Line analysis on each vendor.\u00a0<\/span><\/p>\n What are five lessons from privileged access management experts in the wake of 2019 data breaches?\u00a0 Throughout 2019, enterprises learned the hard way about the necessity of privileged access management to prevent data breaches. Indeed, privileged access solution provider Centrify found 74% of data breaches begin with a compromised privileged account. However, enterprises continue to […]<\/p>\n","protected":false},"author":41,"featured_media":2993,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[1031,142,125,987,16,76,1169,145,124,123,90,1247,25,1157,1248],"acf":[],"yoast_head":"\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/01\/PAM_BG_SB_800.gif\" "\\"\\"")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\nFive Lessons From Privileged Access Management Experts in 2019\u00a0 <\/b>\u00a0\u00a0\u00a0\u00a0<\/span><\/h2>\n
The Quest Diagnostics Breach<\/b><\/h3>\n
The Chipotle Credential Stuffing Attack<\/b><\/h3>\n
The VFEmail Incident<\/b><\/h3>\n
The State Farm Credential Stuffing Attack\u00a0<\/b><\/h3>\n
The MoviePass Data Exposure<\/b><\/h3>\n
How to Learn More<\/b><\/h3>\n
Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"