An article was published last month indicating a malware-infected computer at ConnecticutCollege was the cause of the breach of 18,000 social security numbers of teachers, employees, and student workers. According to the report, "a computer in the CCSU business office was infected in December, and sat on the system for eight days before it was detected and removed." By now we all know that data breaches are bad. We understand the ramifications of lost/manipulated/stolen data. We know they should be avoided at all costs. So why do they keep happening?
Maybe it's because IT organizations aren't treating the root cause of the problem. Since we led with the Connecticut College incident, let's use it as an example. I'm sure there were extensive firewalls protecting the sensitive information of those 18,000 people. I have no doubt that a lot of thought and planning went into the anti-malware software that was supposedly protecting the corporate network. But what happens when that's not enough? Firewalls and anti-malware software are just Band-Aids when it comes to treating IT security as a whole. While they help by placing a barrier between the outside world and the goings on of the corporate network, they don't actually treat or solve the cause of why the breaches are occurring in the first place.
Unmanaged and unaudited administrative credentials and root access are at the cause of data breaches. Bottom line. These credentials can be hijacked by malware and allow hacks to occur in otherwise secure corporate networks. To properly treat the problems that cause data breaches, these credentials MUST be managed. Users must have access to tasks necessary for job functionality, but not too many that they can access anything at any time. When this kind of freedom is allowed your users, malware can take hold and your data becomes insecure. Fortunately, BeyondTrust can help. Click here for more information on ways to manage administrative credentials the right way and reduce the threat of malware in your organization.
Maybe it's because IT organizations aren't treating the root cause of the problem. Since we led with the Connecticut College incident, let's use it as an example. I'm sure there were extensive firewalls protecting the sensitive information of those 18,000 people. I have no doubt that a lot of thought and planning went into the anti-malware software that was supposedly protecting the corporate network. But what happens when that's not enough? Firewalls and anti-malware software are just Band-Aids when it comes to treating IT security as a whole. While they help by placing a barrier between the outside world and the goings on of the corporate network, they don't actually treat or solve the cause of why the breaches are occurring in the first place.
Unmanaged and unaudited administrative credentials and root access are at the cause of data breaches. Bottom line. These credentials can be hijacked by malware and allow hacks to occur in otherwise secure corporate networks. To properly treat the problems that cause data breaches, these credentials MUST be managed. Users must have access to tasks necessary for job functionality, but not too many that they can access anything at any time. When this kind of freedom is allowed your users, malware can take hold and your data becomes insecure. Fortunately, BeyondTrust can help. Click here for more information on ways to manage administrative credentials the right way and reduce the threat of malware in your organization.
Scott Lang, Sr. Director, Product Marketing at BeyondTrust
Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.