Lessons to Learn from This Year’s Security Breaches

For those that only follow the high profile security breaches that make the evening news, it’s likely obvious corporations in general are under constant attack.  For every security breach that you hear about, hundreds go under the radar because the companies are not household names or the amount of data exposed is not enough to grab headlines.

Here are just a handful of breaches that have happened so far in 2015, most of which people are not talking about:

Moral of the story…no organization is a low risk target any longer.

Therefore, I think it’s important to ask yourself, “What is the difference between an insider and a hacker?” I posed this question for a group of security professionals, and, after an intense debate, we agreed that there really is no difference except insiders are paid employees of the company and hackers extract their payment by selling a company's private information.

We should all understand the anatomy of a security breach. Once a client system is breached, the agenda is to get administrative and/or network privileges so you can move around the organization, hopefully using the identity of insiders.

The Verizon 2014 DBIR explains that 88 percent of privilege abuse / misuse "occur within the boundaries of trust necessary to perform normal duties."  Equally concerning is fact that 58% of respondents in the BeyondTrust Privilege Gone Wild 2  report believe that internal security controls are insufficient to control privilege abuse. How is this still possible?

There is a generally accepted belief that we need to balance security and productivity.  However, we often lean too far towards the productivity and this is at the cost of good security.  In hindsight, would Sony, Target, Home Depot, etc., rather have implemented tighter security controls that could have prevented or limited the scope of their breaches at the cost of negligible loss in productivity due to increased security measures?

A number of vendors release surveys in the privilege and vulnerability markets that shed some light on a wide array of challenges when it comes to securing enterprises. In the recent BeyondTrust Privilege Gone Wild 2 report, there are some disturbing but not shocking findings:

47% of respondents report that users in their organizations possess privileges that are not necessary for their roles.

I wish I could say this is an easy problem to solve. You can ask any organization that has poured countless dollars into monolithic frameworks designed to help understand: