August 18, 2015
Thycotic, a provider of privileged account management offerings for global organizations, has announced the results of a survey of 201 white hat and black hat hackers at Black Hat USA 2015. The survey, which was conducted live on August 5 at the conference venue in Las Vegas, found that a majority (75%) of hackers have not seen a fundamental change in the level of difficulty in compromising privileged account credentials, despite an overall increase in IT security spending over the past two years.
Among other topics, the survey also asked hackers how often they come across privileged account credentials in unprotected files like spreadsheets. Only 6% of respondents said they had never seen this, meaning 94% find privileged credentials in unprotected files at least some of the time.
Other key findings from the survey include:
* Hackers indicated that privileged account credentials are the best targeted assets for gaining direct access to large amounts of critical data. 45% identified privileged credentials as their favorite target, while only 33% chose end user credentials as the easiest way to get what they are after.
* Nine out of 10 respondents said it is as easy as or even easier to compromise privileged account credentials now than it was two years ago
* Healthcare organizations were indicated to be the primary target for breach vulnerability (29%), followed by financial services companies (25%) and government organizations (24%).
“Perhaps not surprising to those in the cybersecurity industry, it is apparent that for all the new defensive solutions that have been introduced, we still haven’t cracked the code on how best to protect mission-critical data and company secrets, and in fact, in some cases we’re only adding additional layers of complexity which provide attackers more attack vectors to use to break in,” said Nathan Wenzler, senior technology evangelist at Thycotic.
“It’s also clear from the data that even some of the most basic security practices are still not being enforced well enough by organizations and privileged login credentials are constantly left vulnerable to intruders.”
Further information is available at www.thycotic.com.