Feeds

350 DBAs stare blankly when reminded super-users can pinch data

A password is for life, not just for Christmas

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Enterprises are ripe picking grounds for would-be Ed Snowdens, according to a survey conducted by the Ponemon Institute for Raytheon that found hundreds of organisations did not have policies to limit the amount of sensitive data staff can access.

The survey of 700 techies found Snowdens-in-waiting were typically database administrators, network engineers, infosec bods and "cloud custodians", who were doled out access rights on an ad-hoc basis.

The real Ed Snowden abused his access rights as a system administrator or infrastructure analyst for the National Security Analyst to siphon off the now infamous slide decks that revealed extensive spy operations by Five Eyes agencies.

The report says staff can cause more damage to organisations than external attackers.

"Damage caused by privileged users is the most extensive, the hardest to mitigate and the hardest to detect as it is done by authorised users doing things they are authorised to do," the report read (pdf).

"They are often very technically savvy and have elevated access to systems making it easy for them to cover their tracks ... cases of fraud and theft by privileged users often go undetected and unsolved."

Raytheon said many felt empowered by their regal privilege rights and already abused their positions by tapping into "all the information they can view", including the most sensitive data held by their companies.

Most users claimed they needed sweeping access to do their jobs but the remaining 25 per cent said their companies either handed out privileged rights to everyone or failed to revoke access when it was no longer required.

Snowden clones would probably get away with stealing secrets. Raytheon said most respondents' organisations lacked the intel required to identify data stolen by insiders or were bamboozled by false positives that incorrectly flagged rampant data pillaging.

About a third of respondents said access right policies were well defined and controlled by IT.

In Australia, insider fraud cases were often a matter for civil courts which led to bills totalling in some cases hundreds of millions of dollars.

Organisations had been defrauded by staff stealing real estate client lists, patient health care records and corporate intellectual property. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.