I’m really starting to enjoy the “odd” months, Microsoft kept to their pattern and released only four security bulletins today. A welcome reprieve from last month’s sixteen bulletins. The only “Critical” rated vulnerability released today affects the Windows Bluetooth 2.1 stack. This particular vulnerability is somewhat interesting due to the attack vector. As you know,…
Last week reports of a study done by the U.S. Department of Homeland Security were flying around the Internet, highlighting that if you simply drop a bunch of USB drives in your corporate parking lot, approximately 60 percent of your employees will pick up the drives, take them into the office and plug them into their computer. While the results of this study are being disputed, this tells us one thing definitively: employees are a huge security risk.
At eEye we have been continuing an aggressive release schedule of major product updates that simplify your vulnerability management and compliance process. One of the ways that we continue to simplify vulnerability management is through new capabilities and reporting that allow for better prioritization of vulnerabilities from an overall risk management perspective. While other products…
In order to put a face on the depth and breadth of potential insiders that can be found throughout your enterprise, I will introduce you to three insider villains and three insider heroes. Each villain will represent one of the key misuse of privileges and each hero will represent key values delivered by least privilege. This first introduction will be of the most impactful and prevalent villain.
It seems like you can’t turn on the news or surf the web without hearing about yet another data breach or information security attack, all of which lead to further consumer unrest and corporate concern about the protection of their own sensitive data. The security structure within most organizations generally provides a multitude of security mechanisms designed to provide protection of sensitive information, but with so many different aspects of security to consider, IT administrators and security officers need to be sure not to overlook the Active Directory.
|Exploit Impact:||Information Disclosure
Industry analysts have classified the privilege identity management space into Super User Privileged Management (SUPM) and Shared Account Password Management (SAPM). When it comes to crashing your enterprise systems, destroying data, deleting or creating accounts and changing passwords, it’s not just malicious hackers you need to worry about.
I have tried to purposely keep this blog away from anything even remotely BeyondTrust sales-oriented and focus instead on the information, education and proof-points that examine the whys and hows of implementing least privilege across your extended enterprise. Today will be an exception.
Many organizations have invested heavily in perimeter security, helping to protect against hackers and outside threats, but very few have addressed the weak link in the security chain. Users with excessive privileges are that weak link, and allowing users to make security decisions can have disastrous consequences.
In the spirit of keeping blog posts informative, short and fun, this one takes a cue from David Letterman in format. So without further fanfare or wasted space… the Top 10 Reasons to Implement Least Privilege for Applications and Databases. How may of these have you seen throughout your organization?