The Perils of Poor Privileged Account Management

The Perils of Poor Privileged Account Management

The Perils of Poor Privileged Account Management

Privileged accounts are the keys to the kingdom, yet the majority of IT pros admit lax account management practices open up their company to serious security risks.

Privileged Account Management Challenges

The top three challenges respondents face managing administrative or other privilege passwords: Default admin passwords on hardware and software not consistently changed: 37%, Multiple administrators share a common set of credentials: 37%, Can't consistently identify individuals responsible for administrator activities: 31%

Better Control Would Reduce Risk

Asked whether better control of administrative or other privileged accounts would reduce the likelihood of a security breach, 76% of respondents said yes and 24% said no.

Most Have Process for Managing Privileged Accounts

77% of respondents said their companies have a defined process for managing administrative or other privileged accounts. 23% said their companies have no such process.

The Majority Use Software to Manage Privileged Accounts

The three types of software respondents use are: Password vault: 41%, Internally developed tools or scripts: 39%, Change management software: 31%

Delegation Is Critical to Privileged Account Management

Asked which management practices are most critical to their organization, respondents chose delegation (implementing a least-privilege model by which administrators are only given sufficient rights to do their job) and password vaulting (automated storage, issuance and changing administrative credentials).

Less Than Half Log Privileged Access

49% of respondents record, log or monitor some but not all administrative or other privileged access, 42% do so for all access, and 9% do not do any of these.

Most Have Process for Changing Passwords

Asked whether their company has a defined process for changing the default admin password on hardware and software when new resources are brought in, 72% said yes and 28% said no.

Few Change Passwords Monthly

Only 26% of respondents said administrative or other privileged passwords on mission-critical systems are changed monthly.

Best Practices

Dell offers the following best practices for securing privileged accounts and alleviating risk to business: Take inventory of privileged accounts, including users and the systems that use them. Ensure that privileged passwords are stored securely, enforce strict requirements for access and change management processes for privileged passwords. Ensure individual accountability and least-privileged access. Log and/or monitor all privileged access. Audit use of privileged access regularly.