BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Insider Villain Introduced: Accident ProneAnnie

Post by Peter McCalister July 15, 2011

In order to put a face on the depth and breadth of potential insiders that can be found throughout your enterprise, I will introduce you to three insider villains and three insider heroes. Each villain will represent one of the key misuse of privileges and each hero will represent key values delivered by least privilege. This third introduction will be of the most unlikely villain.

Accidental misuse of privilege is commonplace throughout your organization. Why? Because human nature dictate that we will make mistakes and if your employees are over privileged on their IT resources then that can lead to costly mistakes. To better examine this type of privilege misuse I’d like to introduce you to “Accident Prone Annie.”

Annie is your typical business user who accidental may be misusing their privileges to do things that are against corporate policy (i.e. downloading software off the web or upgrading applications before IT approves) and reeking havoc on the help desk.

Accidental misuse of privileges on desktops and servers does happen, and it does have a measurable impact on the organization as a whole. For example, desktop configuration errors cost companies an average of $120/PC, according to IDC report, “The Relationship between IT Labor Costs and Best Practices for IAM.”

As one famous hacker said, “The weakest link in any network is its people.” The most fortified network is still vulnerable if users can be tricked into undermining its security — for example, by giving away passwords or other confidential data over the phone, or performing some activity that allows malware to hijack admin rights on desktops.

Leave a Reply

Additional articles

smart rules manager for vulnerabilities - v2

A New Way of Looking at Vulnerabilities in Your Environment

Assets, users, vulnerabilities and exploits; all are common themes in my posts on BeyondInsight. With BeyondInsight v5.1, we unveiled a new way to view exploitable assets. Sure, most vulnerability management solutions link vulnerability data to exploit information, allowing tools like NeXpose and QualysGuard to list an asset, its vulnerabilities, and any related exploits. BeyondInsight does…

Post by Morey Haber April 23, 2014
Tags:
, , , , ,
smart rules manager for vulnerabilities

Staying on Top of the Latest Vulnerabilities with BeyondInsight v5.1

It’s no secret that dozens of new OS and application vulnerabilities are revealed every day. Staying on top of these new exposures normally requires paying for services or subscribing to multiple RSS feeds. BeyondInsight 5.1 provides customers with another option: a built-in, customizable vulnerability alerting system that delivers up-to-date information on the latest vulnerabilities in…

Post by Morey Haber April 21, 2014
Tags:
, , , , , ,
BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,