Snooping IT staff

November 2008 Security Services & Risk Management

A third of IT staff secretly peek at confidential data.

Whilst you sit there innocently working away, little do you realise that a third of your IT colleagues have been snooping around the network, looking at highly confidential information, such as salary details, M&A plans, people’s personal e-mails, board meeting minutes and other personal information. That is the findings of a survey released by Cyber-Ark Software, specialists in digital vaulting solutions, who carried out the research at the recent Infosecurity Expo 2008, amongst 300 senior IT professionals (mainly from companies employing over 1000+ employees), as part of their annual survey into 'Trust, security and passwords'.

One third of the survey sampled admitted to using their privileged rights to access information that is confidential or sensitive by using the administrative passwords as a means of peeking at information that they are not privy to.

When asked if they had accessed information that was not relevant to their role 47% admitted they had.

Udi Mokady, CEO of Cyber-Ark says, “When it comes down to it, IT has essentially enabled snooping to happen. It is easy, all you need is access to the right passwords or privileged accounts and you are privy to everything that is going on within your company. Gone are the days when you had to photocopy sheets of information with your customer database on it, or pick the lock to the salaries drawer. In some organisations there is little understanding or lack of controls in place to manage workers access to systems. For most people, administrative passwords are a seemingly innocuous tool used by the IT department to update or amend systems. To those 'in the know' they are the keys to the kingdom and if unprotected or fall into the wrong hands wield a great deal of power. This could include highly sensitive information such as merger plans, the CEO’s e-mails, company accounts, marketing plans, legal records, R&D plans etc.”

Privileged passwords rarely get changed

Even more worrying is the fact that privileged passwords get changed infrequently and often a lot less than user passwords. 30% get changed every quarter and a staggering 9% never get changed, giving access indefinitely to all those who know the passwords, even when they have left the organisation.

Who is managing the privileged passwords?

Half of IT administrators do not have to get authorisation to access privileged accounts which shows a general lack of control of these power identities and indeed understanding over the power that these privileges command.

Majority are sloppy at handling and exchanging sensitive data

Seven out of 10 companies rely on out-dated and insecure methods to exchange sensitive data when it comes to passing it between themselves and their business partners with 35% choosing to e-mail sensitive data, 35% sending it via a courier, 22% using FTP and 4% still relying on the postal system. This should not be any big surprise when you learn that 12% of these senior IT personnel who were interviewed also choose to send cash in the post.

Mokady continues, “As we have seen many use their privileged passwords without having to seek authorisation, and if the price is right what is stopping them from choosing to trade information to the highest bidder. Companies need to wake up to the fact that if they do not introduce layers of security and tighten up who has access to vital information, by managing and controlling privileged passwords, snooping, sabotage and hacking will continue.”

For more information contact Darshna Kamani, Cyber-Ark, 020 71832 832.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

SAFPS issues SAPS impersonation scam warning
News & Events Security Services & Risk Management
The Southern African Fraud Prevention Service (SAFPS) is warning the public against a scam in which scammers pose as members of the South African Police Service (SAPS) and trick and intimidate individuals into handing over personal and financial information.

Read more...
Rewriting the rules of reputation
Technews Publishing Editor's Choice Security Services & Risk Management
Public Relations is more crucial than ever in the generative AI and LLMs age. AI-driven search engines no longer just scan social media or reviews, they prioritise authoritative, editorial content.

Read more...
How can South African organisations fast-track their AI initiatives?
AI & Data Analytics Security Services & Risk Management
While the AI market in South Africa is anticipated to grow by nearly 30% annually over the next five years, tapping into the promise and potential of AI is not easy.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Stallion repositions itself as a services provider
News & Events Security Services & Risk Management
Stallion has rebranded as Stallion Integrated Solutions to reflect its expanded capabilities beyond traditional security services to delivering integrated solutions that enhance safety, asset management, and operational efficiency.

Read more...
Seven tips to help ensure your backup batteries work
Power Management Security Services & Risk Management
Load shedding is back, officially or not. Lance Dickerson offers seven tips to prolong the life of your power backup systems and ensure they perform as intended when needed.

Read more...
Cybersecurity best practice
Information Security Security Services & Risk Management
Breach and attack simulation has become an essential element of cybersecurity strategies in any modern business by allowing companies to actively detect and resolve vulnerabilities through real-world attack simulations.

Read more...
Historic Collaboration cuts ATM Bombings by 30%
Online Intelligence Editor's Choice News & Events Security Services & Risk Management
Project Big-Bang, a collaborative industry-wide task team, has successfully reduced ATM bombings in South Africa by 30,7% during the predetermined measurement period of November, December and January 2024/5.

Read more...
Keeping safety central to enterprise risk management
Zulu Consulting Security Services & Risk Management
[Sponsored] As employee safety becomes an ever-more critical aspect of corporate risk management, Risk-IO assists risk managers in ensuring a safe working environment, whether in an industrial setting, an office, or anywhere.

Read more...
Empower individuals to control their biometric data
Information Security Access Control & Identity Management Security Services & Risk Management
What if your biometrics, now embedded in devices, workplaces, and airports, promising seamless access and enhanced security, was your greatest vulnerability in a cyberattack? Cybercriminals are focusing on knowing where biometric data is stored.

Read more...