Many businesses still failing badly when it comes to password security

A new piece of security research has emerged, and while there are positive aspects here, there are the usual worrying statistics to chew over as well.

And probably the most concerning nugget to be revealed by CyberArk's tenth Global Advanced Threat Landscape Survey (which is published yearly) is the fact that 40% of businesses store admin passwords in a simple Word document or a spreadsheet – with 28% of organisations storing them on a USB stick or shared server.

The report, which took in the opinions of 750 IT decision-makers (including C-level execs and directors across the globe) did also find that 82% said they felt the IT security industry was making progress in defending against cyber-attacks.

And 79% of respondents said that their company had 'learned lessons' from major cyber-attacks and had taken action to improve security as a result. Those actions included the deployment of malware detection (in 25% of cases) or endpoint security (24%), or the use of security analytics (16%).

Another positive point was the fact that 67% of those questioned said that they believed their chief executive and board of directors provided 'sound' security leadership, which was a sizeable jump from the 57% recorded in 2015.

Remote concerns

But before we get carried away with the more positive info, here comes another worrying stat – namely that 49% of businesses allow third-party vendors (such as IT management outfits) to have remote access to their internal networks.

Now while that's not necessarily a bad thing in itself, providing the correct security and monitoring processes are followed, of course not everybody does so. And the report found that the public sector had the worst level of third-party vendor access controls compared to private firms, with 21% failing to secure remote access properly, and 33% failing to monitor the connection.

Other weaknesses include the lack of testing of any cybersecurity emergency response plan. While it's commendable that 95% of businesses have one of these in place, only 45% of companies regularly test that plan with their staff members.

And 36% of respondents said they believed a hacker is currently on their network, or has been within the last year. But despite that, three-quarters of those surveyed said they believe they can prevent cyber-attackers from breaking into their internal network.

One final nugget for you on ransomware – 46% said they thought their firm had been the victim of one of these stings in the past two years, again showing the prevalence of this form of attack. Ransomware can be particularly lucrative against businesses, because the attackers can obviously demand far more of a ransom than they can extract from an individual.

John Worrall, CMO at CyberArk, commented: "The findings of this year's Global Advanced Threat Landscape Survey demonstrate that cybersecurity awareness doesn't always equate to being secure. Organisations undermine their own efforts by failing to enforce well-known security best practices around potential vulnerabilities associated with privileged accounts, third-party vendor access and data stored in the cloud."

Via: WinBeta

• If you do get hit by ransomware, should you ever pay up?

http://ift.tt/2cZCljM