Forcepoint & Ponemon: Organizations challenged when monitoring privileged users, preventing insider threats

Forcepoint in partnership with the Ponemon Institute, IT security research organization, released the results of its “Insecurity of Privileged Users” study, comparing data sets from 2011 and 2014 with present day. Although insider leaks and attacks continue to multiply, this study found that 58 percent of IT operations and security managers believe their organizations are unnecessarily granting access to individuals beyond their roles or responsibilities with 91 percent predicting the risk of insider threats will continue to grow or stay the same.

With more than 40 percent of respondents agreeing that malicious insiders would use social engineering to obtain privileged user access rights – up 20 percent from 2011 data – it’s no surprise then that the majority of those surveyed expect insider threats to remain an issue. More than 600 commercial and 142 federal IT operations and security managers participated in the study.

Approximately 70 percent of both groups surveyed think it is “very likely” or “likely” that privileged users believe they are empowered to access all the information they can view. Nearly 70 percent also believe that privileged users access sensitive or confidential data simply out of curiosity. With these large percentages in mind, only 43 percent of commercial and 51 percent of federal organizations today said they have the capability to effectively monitor their privileged user activities. A majority said that only 10 percent or less of their budget is dedicated to addressing this significant challenge.

While budget and the human element are factors in addressing the insider threat challenge, technology deficiencies are also playing a role. The survey found that a significant number of respondents use existing cybersecurity tools to combat insider threats, rather than more targeted technologies (e.g. 48 percent of commercial and 52 percent of federal organizations use a SIEM to determine if an action is an insider threat). As a result, more than 60 percent indicated that these tools yield too many false positives. What’s more, a majority of both audiences surveyed (63 percent commercial and 75 percent of federal organizations) lack the necessary contextual information required to prevent insider threats from happening.

Leave a Reply

Your email address will not be published. Required fields are marked *