HK firms find difficulty in managing privileged passwords

Nine of 10 respondents (91%) in a recent poll admitted to facing challenges when it comes to managing privileged passwords, and one in five (18%) still use a paper-based logbook to manage privileged accounts in Hong Kong.

These are some key results of a global study recently conducted by Dimensional Research that explored over 900 IT security professionals on the challenges, habits and trends related to managing access to corporate data. The study was conducted on behalf of IAM vendor One Identity.

These findings are significant considering that privileged accounts grant virtually unlimited access to nearly every component of a company’s IT infrastructure, essentially handing over the keys to a company’s most critical and sensitive systems and data.

“Privileged accounts present an easy target for hackers or even malicious employees when poor security and management processes exist within an organization. The results from Hong Kong are especially worrying, revealing the extent to which organizations are at risk to data theft, and highlights the urgent need for businesses to raise their standards in privileged access management,” said Lennie Tan, vice president and general manager, One Identity, Asia Pacific & Japan.

The survey also exposed three key areas where distressingly inferior practices for privileged account management occur, including:

l   Management platforms and tools: In addition to 18% of respondents admitting to using paper-based logs, a surprising 28% are using equally inadequate spreadsheets for tracking privileged accounts in Hong Kong. The survey also found that two-thirds (67%) of companies globally are relying on two or more tools to manage these accounts -- indicating widespread inconsistency in privileged access management (PAM).

l   Monitoring and visibility: The majority of IT security professionals (52%) in Hong Kong admit to only monitoring some privileged accounts, or not monitoring privileged access at all. Even worse, 28% of respondents confessed they are unable to monitor or record activity performed with admin credentials, while 35% said they cannot consistently identify individuals who perform admin activities.

l   Password management and change: An overwhelming 88% of organizations in Hong Kong are not consistently changing the password on their admin accounts after each use. Further, 35% of IT security administrators don’t take the basic best practice of changing a default admin password. By not adhering to these best practices, privileged accounts are vulnerable to open the door to data exfiltration or worse, if compromised.

“When an organization doesn’t implement the very basic processes for security and management around privileged accounts, they are exposing themselves to significant risk. Over and over again, breaches from hacked privileged accounts have resulted in astronomical mitigation costs, as well as data theft and tarnished brands,” said John Milburn, president and general manager of One Identity. “These survey results indicate that there are an alarmingly high percentage of companies that don’t have proper procedures in place. It is crucial for organizations to implement best practices regarding privileged access management without creating new roadblocks for work to get done.”

Image from