Employees in business have too much access to sensitive data

The study even meant that 49% of employees access just out of curiosity.

According to a study by Ponemon Institute, about 40% of employees are able to access sensitive data in their company when they do not need it in the course of their tasks.

This article will also interest you: Cybercrime and Data: When Hackers Threaten to Disclosure Sensitive Data

Everything about access management is very sensitive. The majority of the computer security of pump organizations clearly this aspect. With the coronavirus pandemic forcing a widespread use of remote work, the problem of access has become something even more difficult to manage. Because it was not necessary to give its employees access to content in the company's database when the company does not necessarily connect with approved tools.

While organizations are trying to organize their governance to the best of their ability, some problems were quickly detected.

In its recent report, following a yearly research by Forcepoint, Ponemon Institute to mean that too many people have access to certain information when this should not be the case.

The interviewees for this study are professionals in the field. These include:

– security professionals

– cloud service professionals

– database administrators

This study highlighted the fact that many employees often inappropriately use certain accesses that could endanger multiple sensitive data in their organization.

First, 49% of respondents reported that people with privileged access had repeatedly accessed sensitive data when this was not even necessary and only out of curiosity.

36 percent of respondents in the United States and the United Kingdom said they did not need this kind of privileged access to do their job effectively. According to their explanations, organizations tend not to often remove access from their employees when their status changes. As a result, some had certain rights that they were not supposed to have.

In addition, as a result of this report, Forcepoint comments: "The large number of privileged users makes, to some extent, the abuses inevitable. But abuse must not turn into a real data breach. Monitoring user behaviour and activity, which can determine the context and intent of a particular user's actions, is one of the keys to reducing abuse of privileged users. Monitoring user activity requires the ability to correlate activity from keystrokes, badge recordings, etc. It should also include features such as DVR-type playback to discern the intent of the end user. Robust automation is essential to ensure that this level of monitoring does not create friction for employees who are also trying to do their jobs. Behavioural Analysis uses Indicators of Behavior (IOB) to determine behaviour risk by using a mixture of computer data, non-computer data and psychological factors to understand risk at an early stage. It is important to take proactive measures, depending on the level of risk, to mitigate this risk through the application of granular policies.

"Without granular visibility (visibility not only on who has access to it, but also on what they do with it), companies cannot detect or react quickly enough to compromised or malicious access to remain protected. The key principle here is a zero trust motto: 'never trust, always check' especially since the threat of the preferred user shows no signs of diminishing. Economic pressure leads to understaffed businesses, leading to stressed employees who are more likely to take shortcuts in a way that threatens security. Especially now, real-time visibility of users' access and actions should not be negotiable.

"In a computer environment, privilege can mean several things: access to a particular application or data set; Permission to stop or configure systems the power to circumvent certain security measures. In some cases, this privilege is required for an urgent task. In others, this represents not only unnecessary access, but an unnecessary risk. Organizations need to do a better job of tracking not only access, but behavior once access is granted, in order to prevent and respond to data breaches."

Forcepoint Director Nico Popp notes: "To effectively understand the risk posed by insiders, you need more than just looking at newspapers and configuration changes." He later clarified: "Incident-based security tools generate too many false positives. Instead, IT managers should be able to correlate activity from multiple sources, such as incident tickets and badge recordings, view the archives and video of keystrokes, and take advantage of user and feature behavior analysis tools. Unfortunately, these are all areas in which many organizations fail."

Now access an unlimited number of passwords: