88% of IT admins would steal data if fired
So the survey says
An IT administrator scorned is not to be trusted, according to a study recently conducted by Cyber-Ark.
The security firm claims a survey conducted on 300 security professionals found a whopping 88 per cent of IT admins would steal valuable and sensitive company information if they were fired tomorrow. Only 12 per cent said they'd leave empty handed — or at least were smart enough not to openly admit they'd plunder sensitive data on a questionnaire.
"Our advice is to secure these privileged passwords and identities, and routinely change and manage them so that if an employee's contract is terminated, whether voluntary or not, they can't maliciously wreak havoc inside the network or vindictively steal data for competitive or financial gain," said Cyber-Ark CEO Udi Mokady.
We should note Cyber-Ark sells products that manage, log, and update privileged passwords, so swallow that incredibly high percentage with a grain of salt - or twenty. A vested-interest doesn't necessarily mean the findings are bunk, however.
Based on the average amount of barely-bottled rage we field from data center denizens, we dare say they caught the troops in a moment of vulnerable honesty. Bless them.
In other tid-bits, a quarter of the companies polled admitted to suffering from internal sabotage and security fraud in their workplace. One third said they believe industrial espionage and data leakage is occurring within their company.
But even paying the big bucks for security systems doesn't mean a thing when admins get sloppy. One third of IT admins surveyed admit to having written down privileged passwords on a post-it note. ®
Im sorry but i dont understand?
So Mr Anonymous Coward, you are saying that because you were given complete access to everything in a job you USED to have, and you didnt steal any data, the survey we ran was not accurate?
And apparantly we SHOULDNT of asked the people if they had administrative privileges because THAT also makes our survey less accurate?
I respect you for your honesty in revealing that you would never steal data (I think I mentioned my respect for all honest admins in an earlier post - apologies if I didnt) but I can only publish what I am given.
Once again, I urge all of you, ONE AND ALL, come to our stand at infosecurity 2009 and take the survey!
And once again, I refer you to the ZDnet survey that was completely independent that came up with the same results.
Not so smiley face, because it seems I'm not longer the most popular person on the reply list......
Dear Mark Fullbrook - welcome to the wonderful world of statistics
"How did we know they had administrative privileges? Well we asked them of course!" - and THAT was your FIRST mistake... because EVERYONE considers themselves to be more important than they really are and it is often tempting to give answers from a previous job if you think the end result is going to be more rewarding.
I, for example, have absolutely no admin privileges at my current place of work although I know a damned sight more IT, security, networking, software use and installation etc etc than the guy who, thanks to a rudimentary MicroShaft Certificate, does. To be honest, I know a damned sight more bloody English Grammer than that fool too but that's another story.
A previous job saw me as a highly respected member of a small team (a team of 2 - me and my boss - who could not even muster the title of 'computer illiterate') within a massive multi-location network - and my admin access was rediculous - primarily by the nature of the network but also because I proved time and again to the central support group that I was not going to accidentally install service pack 2 without checking first, or delete someone's homedrive before they left. I couldn't say I ever went "somewhere I shouldn't" however, because there was NOWHERE that I "shouldn't" go... albeit once I had proved that I wasn't going to fuck the network, the local system, the backups or the users in the process. I was, to the bulk of the users (minors) some sort of omnipotent Web-Pig... I saw it all... every homedrive, every webpage, every screenshot. The best bit, naturally... was deleting pictures of page3 girlies in bikinis from the homedrives of the 6th years and leaving a text file saying - "next time I'll show the HeadMaster". Mwah - All your nudies are belong to me.
So now, when you ask - did I take anything away with me - indeed I did; memories mostly... wonderful warm memories. Lies are one thing, I do not suffer liars myself either and applaud your decision to respond... but, as was so eloquently added above, 88% of statistics are made up on the spot - or at least they might as well be because 100% of individuals know how to manipulate the truth, even if none of them resorts to lying. Now might be a good time to wipe that misplaced smile off your face.
@nonsense and beyond
Buster, gosh look who has crawled out of a bad 1950's movie :)
I am guessing it was the bad odour comment that got you - perhaps that is why you are not seeing much skirt; Eau de Admin - population control in a bottle.
Seriously, most winows admin work is the one eyed man with a squint, who is serf to the numpties, in the land of the blind and deaf.
There is no reason for admins to have the password to secure encrypted data.
There exist many methods where data can be made secure, none of which involves IT administration - though of course a developer would have to write the application :)
Well, let me take some gems:
'They actually have a completely different skill set than developers. '
You jest, skillset hmmm stretching the English language somewhat there.
'.. who don't know what a fucking subnet is, and think that "routing" is something done by that thing stuck to their windscreen'
I like this one, fighting talk. Quite right, some developers are not really developers either, in fact those are the vb and .net weenies.
Though let's play - subnetting is the act of taking a range of sequential ip addresses and assigning a network to it with an optional broadcast, hence a description of a CIDR of 172.22.5.9/29 would indicate a network range of 172.22.5.8 - 172.22.5.15. Hardly rocket science now is it.
Routing is even simpler. How hard is it to type:
route add 172.22.55.8 netmask 255.255.255.248 gw 172.22.55.10 eth6:2
Now the question is, have I put in a deliberate mistake or not?
You would have more marks awarded had you mentioned BGP.
'Hope your admin turns off your remote server for good, and electrifies the door handles!'
See now that is what I am talking about - unprincipled to the nines; oh admin push button, admin make thing not work, idiots, oh Developer takes red hot iron and pushes it up where the sun doesn't get a look in.
'You've obviously never seen a real Windows admin'
You're quite right - and neither have I seen pixies or santa claus :) A Real Windows admin, ohhh what a terrifying sight that must be to behold. Though I like that distinction it is not all admins, just the pretend Windows ones.
'I find the major danger to systems are the users... Especially the users who think they 'know it all'.'
Yes you have hit the nail on the proverbial head, Windows Admins are those l'users, quite incompetent, and yes they think they know it all. But, really they know such a tiny minute fraction that is probably not even worth attributing the term knowledge to it.
Perhaps we could call window admins, guessers, they take their finger out of their butts wave it in the wind, see which way it sitnks and then press a button.
'I take it they won't let you have admin rights then?'
No, actually quite the opposite, they are more annoyed I nerf their admin privileges, so they are stuck with no omnipotence on the systems or network; just how it should be. Little roles for little people is what I tell 'em.
This one really does take the biscuit (and the half drunk can of coke).
'Without admins you would not have a environment to develop on.'
Phwooar, who the hell do you think wrote those environments, deluded microweenie. Window admins have to make do with the scraps that developers throw them. Like a pack of famished scrawny little dogs; window admins, leap to digest the little trinkets of code dangled in front of them. You do realise that is done for sport.
Well that was quite good fun, but you know what IT is a power game, at times it has to be said who wears the big boy trousers in the relationship, and who is the bitch. Bend over window admin boys, you work for developers, and stop stealing the data :)
Water is wet, fire burns, the Pope's a Catholic, bears shit in woods.
We may have met a few years ago at a SANS conference. You have an interesting suite of products. And I would like to say to you and all the other posters that you stats are probably correct. I have never left a company empty handed, whether that be a key for a spendy piece of software, or some clever bit of scripting I wrote, and don't want to have to re-invent elsewhere. That in of itself would put me on your list. However, I am a skilled unix admin and security professional, it is my job to see that the things I can do to your company can't be done by others. I consider all of an employers systems to be MY systems for the duration of my employment, and I treat them as such [properly operating and secured, etc]. All of my employers consider me to be trustworthy, and I have never given them cause to think otherwise, but I am a sysadmin and not to be trifled with, for thou art crunch and taste good with catsup ;)
I would have no problems with crushing those who deserve it. Not AC. I have nothing to fear.