IT Pros Can’t Resist Peeking At Private Data

Data Security

Analysis of a 2011 password survey has shown that IT security staff will be some of the most informed people at the office Christmas party this year. A full 26 per cent of them admit to using their privileged log in rights to look at confidential information they should not have had access to in the first place.

A detailed look at what IT security staff shared during the recent password survey found that IT professionals just cannot resist peeking at information that is supposedly barred to them. It has proved just too tempting, and maybe just human nature, for them to rifle through redundancy lists, payroll information and other sensitive data including, for example, other people’s Christmas bonus details.

If it’s human nature to pry it is also human nature to confide in someone once you have done it. IT security staff were very forthcoming with Lieberman Software during the survey. The survey of more than 300 IT professionals shows that a fundamental lack of IT security awareness in enterprises, particularly in the arena of password control and privileged logins, is potentially paving the way for a further wave of data breaches in 2012.

  • 42 percent of those surveyed said that in their organisations’ IT staff are sharing passwords or access to systems or applications
  • 26 percent said that they were aware of an IT staff member abusing a privileged login to illicitly access sensitive information
  • 48 percent of respondents work at companies that are still not changing their privileged passwords within 90 days – a violation of most major regulatory compliance mandates and one of the major reasons why hackers are still able to compromise the security of large organisations

The survey shows that senior management at some of the largest organisations are still not taking the management of privileged access to their most sensitive information seriously. When someone can admit that they have unsupervised, unaudited and unauthorised access to all their colleague’s and superior’s bonus details then the IT security of that organization is seriously flawed.

These organisations have to learn from the example of their peers who have taken this situation seriously and introduced Privileged Identity Management software to add a layer of automated security that dishonest staff cannot bypass.

Organisations that fail to do this could end up in the same situation as UBS AG, which lost US $2.3 billion when rogue trader Kweku Adoboli was allowed unfetterd access to their systems and Societe Generale which lost $US 7 billion when Jerome Kerviel was allowed to run up ‘secret trades’ which senior management knew nothing about.”

These fundamentally careless practices and procedures revealed by the IT departments of the organisations we surveyed could cost them dearly in 2012. In many ways they should be breathing a sigh of relief that they have not been breached yet, but it’s just a matter of time.

Password Management and Data Breaches

Privileged accounts hold elevated permission to access files, install and run programs, and change configuration settings. Their misuse is a major reason for data leakage. For many organisations, unmanaged privileged account passwords are the backdoors by which hackers find their way into the enterprise’s most sensitive data.

If almost 50% of all passwords remain unchanged, as this survey discovered, then fundamental and basic IT security practices are being ignored by staff and their senior management.

SHARETweet about this on TwitterShare on LinkedInShare on FacebookShare on Google+Pin on PinterestDigg thisShare on RedditShare on TumblrShare on StumbleUponEmail this to someone

Philip Lieberman, the founder and president of Lieberman Software, has more than 30 years of experience in the software industry. In addition to his proficiency as a software engineer, Philip is an astute entrepreneur able to perceive shortcomings in existing products on the market, and fill those gaps with innovative solutions. He developed the first products for the privileged identity management space, and continues to introduce new solutions to resolve the security threat of privileged account credentials. Philip has published numerous books and articles on computer science, has taught at UCLA, and has authored many computer science courses for Learning Tree International. Philip has a B.A. from San Francisco State University.