Snooping IT staff

November 2008 Security Services & Risk Management

A third of IT staff secretly peek at confidential data.

Whilst you sit there innocently working away, little do you realise that a third of your IT colleagues have been snooping around the network, looking at highly confidential information, such as salary details, M&A plans, people’s personal e-mails, board meeting minutes and other personal information. That is the findings of a survey released by Cyber-Ark Software, specialists in digital vaulting solutions, who carried out the research at the recent Infosecurity Expo 2008, amongst 300 senior IT professionals (mainly from companies employing over 1000+ employees), as part of their annual survey into 'Trust, security and passwords'.

One third of the survey sampled admitted to using their privileged rights to access information that is confidential or sensitive by using the administrative passwords as a means of peeking at information that they are not privy to.

When asked if they had accessed information that was not relevant to their role 47% admitted they had.

Udi Mokady, CEO of Cyber-Ark says, “When it comes down to it, IT has essentially enabled snooping to happen. It is easy, all you need is access to the right passwords or privileged accounts and you are privy to everything that is going on within your company. Gone are the days when you had to photocopy sheets of information with your customer database on it, or pick the lock to the salaries drawer. In some organisations there is little understanding or lack of controls in place to manage workers access to systems. For most people, administrative passwords are a seemingly innocuous tool used by the IT department to update or amend systems. To those 'in the know' they are the keys to the kingdom and if unprotected or fall into the wrong hands wield a great deal of power. This could include highly sensitive information such as merger plans, the CEO’s e-mails, company accounts, marketing plans, legal records, R&D plans etc.”

Privileged passwords rarely get changed

Even more worrying is the fact that privileged passwords get changed infrequently and often a lot less than user passwords. 30% get changed every quarter and a staggering 9% never get changed, giving access indefinitely to all those who know the passwords, even when they have left the organisation.

Who is managing the privileged passwords?

Half of IT administrators do not have to get authorisation to access privileged accounts which shows a general lack of control of these power identities and indeed understanding over the power that these privileges command.

Majority are sloppy at handling and exchanging sensitive data

Seven out of 10 companies rely on out-dated and insecure methods to exchange sensitive data when it comes to passing it between themselves and their business partners with 35% choosing to e-mail sensitive data, 35% sending it via a courier, 22% using FTP and 4% still relying on the postal system. This should not be any big surprise when you learn that 12% of these senior IT personnel who were interviewed also choose to send cash in the post.

Mokady continues, “As we have seen many use their privileged passwords without having to seek authorisation, and if the price is right what is stopping them from choosing to trade information to the highest bidder. Companies need to wake up to the fact that if they do not introduce layers of security and tighten up who has access to vital information, by managing and controlling privileged passwords, snooping, sabotage and hacking will continue.”

For more information contact Darshna Kamani, Cyber-Ark, 020 71832 832.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Understanding the power of digital identity
Access Control & Identity Management Security Services & Risk Management Financial (Industry)
The way we perceive business flourishing is undergoing a paradigm shift, as digital identity and consumer consent redefine the dynamics of transactions, says Shanaaz Trethewey.

Read more...
What you can expect from digital identity in 2024
Access Control & Identity Management Security Services & Risk Management
As biometric identity becomes a central tenet in secure access to finance, government, telecommunications, healthcare services and more, 2024 is expected to be a year where biometrics evolve and important regulatory conversations occur.

Read more...
More than just a criminal record check
iFacts Security Services & Risk Management
When it comes to human-related risks, organisations and their most senior leaders focus on a narrow set of workforce risks, the potential risks that human workers pose to the business.

Read more...
Tech developments lead hologram growth in 2024
News & Events Security Services & Risk Management
Micro-lenses, micro-mirrors and plasmonics are among the rapidly-emerging optical devices that have evolved on the back of holographic and diffractive technologies, and are seen as part of the natural evolution of optical science by R&D teams.

Read more...
Are you leaving money on the table?
Editor's Choice Security Services & Risk Management
How many customers have you helped since starting your business? Where does most of your new business come from? If the answer is not from your database’s existing customers, you might have a problem.

Read more...
The business value of ChatGPT
Security Services & Risk Management Risk Management & Resilience
Transparency, policy and integrity. It is critical for organisations to have a line of sight into processes and procedures that clearly define employee use cases when it comes to ChatGPT, says Lizaan Lewis, Head of the Legal Department at Altron Systems Integration.

Read more...
BMS for smaller businesses
Security Services & Risk Management Products & Solutions Risk Management & Resilience
Small businesses can also benefit from tailored energy management solutions just like large corporations. Effective energy management is essential for more sustainable and efficient operations.

Read more...
Kidnapping for ransom
News & Events Security Services & Risk Management Risk Management & Resilience
There has been an 8,6% increase in reported kidnapping cases in South Africa compared to last year, with 3 854 cases reported between April and June this year, leaving ordinary South Africans increasingly vulnerable.

Read more...
The difference between a SOP and a SOP
Residential Estate (Industry) Integrated Solutions Security Services & Risk Management Risk Management & Resilience
SOPs are a touchy issue that need careful attention and automation to ensure they deliver the desired security results. Beyond design and automation, implementation is the ultimate road to success.

Read more...
Scoping out potential estates
Alwinco Security Services & Risk Management
When an intruder surveys a residential estate of 200 houses, they see at least 200 cars, 400 cell phones, 400 computers, 200 flat screen TVs, 600 bank cards, and various other items of value.

Read more...