Study: Security pros still grappling with lax password policies

Share this article:
Court rules that Google’s data collection practices are not exempt from federal wiretap law.
Court rules that Google’s data collection practices are not exempt from federal wiretap law.

Passwords and cloud security are still causing headaches for IT security professionals, with 13 percent of respondents to Lieberman Software's "2014 Information Security Survey" saying that they can still access systems at a previous place of employment by using old credentials.

Disturbingly, in some cases, the report found, they can even access the systems of two or more employers.

Surveying in person close to 280 IT security professionals — more than 55 percent of whom worked in organizations with 1,000 or more employees — at the RSA Conference 2014 in San Francisco, Lieberman Software also found that nearly 20 percent either do not have, or don't know if their organizations have, a policy for cutting off access to employees and contractors when they leave the company.

Quite a few respondents — nearly one in four — say their organizations don't change their service and process account passwords within 90 days, which is recommended by most mandatory regulations.

Referring to privileged accounts as “the keys to the IT kingdom,” Philip Lieberman, CEO of Lieberman Software, told SCMagazine.com in a Wednesday email correspondence that “it's astonishingly common” in corporate and government networks for the administrator passwords of these “'god' accounts to be shared across multiple systems, remain unchanged for extended periods of time, and be used without any access control or audit records – bad policies all.”

Those security professionals surveyed also indicated some wariness of the cloud, with 80 percent saying they'd choose instead to keep the most sensitive information on their own networks. And, almost three-quarters contend that the cloud applications downloaded by users create security challenges.

The survey notes that by not controlling privileged user access, a persistent problem in many organizations, and failing to adequately secure passwords, organizations are leaving themselves open to attack.

“The high frequency of data breaches can be expected to continue - if not grow,” the Lieberman Software noted in its analysis of the survey results.

Page 1 of 2
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Florida Supreme Court rules warrants a must for real-time cell location tracking

Florida Supreme Court rules warrants a must for ...

The Florida Supreme Court put the kibosh on warrantless real-time tracking using location data obtained from cell phone providers.

Modular malware for OS X includes backdoor, keylogger components

Modular malware for OS X includes backdoor, keylogger ...

The modular malware was named "Ventir," by researchers at Kaspersky.

Fake Dropbox login page nabs credentials, is hosted on Dropbox

Fake Dropbox login page nabs credentials, is hosted ...

Symantec researchers received a phishing email linking recipients to a fake Dropbox login page that is hosted on Dropbox's user content domain and served over SSL.