Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

FISMA 2016... The Best of Times, the Worst of Times

March 21, 2017

  • Blog
  • Archive
FISMA 2016 Depending on the news outlet you visit the 2016 FISMA report could signal the cyber apocalypse, with huge cybersecurity gaps and 16 major cyber incidents in the year. Or, it could be sunny skies with twice as many agencies meeting goals than in the year prior and considerable progress in increasing the cyber workforce. Whether optimistic or pessimistic in your view, the fact remains that nearly 50% of federal agencies reviewed didn’t make the grade; there were just short of 31,000 cyber incidents across thousands of aging IT systems. Federal IT is a complex risky environment that has some distance to go to be secure.

Privilege Abuse & Misuse was at the Center of Many Cyber Incidents

4,130 cyber incidents were the result of improper usage, the “violation of an organization’s acceptable usage policies by an authorized user”. Of the 16 major incidents, 11 involved employee improper usage and exfiltration of large amounts of highly sensitive data. We have two words for this problem... Least Privilege. Called out in the Access Control Family of NIST SP800-53, and as part of the Protect functional area of the NIST Cybersecurity Framework, the principle of least privilege is based on mitigating risk from insider threats by limiting access to the lowest level user rights still allowing employees to do their jobs. This limits exposure of sensitive information or inappropriate access to privileges that would allow unauthorized changes within the information system.

Steps to Balancing Security and Productivity

Some are resistant to implementing least privilege for a variety of reasons, but often it is to avoid slowing down the business at hand, or to avoid overburdening an already stretched IT team. But, folks, if you were one of those agencies reporting the 16 major incidents, I’ll guarantee that’s far more inconvenient than an occasional call about user access. Here are a few steps to take to mitigate the majority of incidents described in the FISMA report:
  • To support efficiencies, grant privileges to applications and tasks, not users. This means the user is never granted administrator credentials but has access to the applications needed.
  • To gain a full picture of privilege activity, analyze privilege password, user and account behavior. This is the key to uncovering emerging privilege escalation threats, pinpointing and reporting on at risk systems, then actively removing the threat. Least privilege doesn’t just mitigate insider threats; it also prevents lateral movement within a system should a breach occur.
Don’t be one of the over 30,000 incidents reported in the next FISMA report. Check out these great resources to start on the path to locking down your agency privileges today. [Video] Least Privilege Management in 2 Minutes [Blog] What Is Least Privilege & Why Do You Need It? [On-demand Webinar] Using Advanced Threat Analytics to Prevent Privilege Escalation Attack [On-demand Webinar] Privileged Accounts: What are They? Where are They? How Do You Find Them? What to Audit? When your agency is ready to explore options to mitigate Federal data breach risks, contact us for a strategy session. BeyondTrust has the experience and solutions to help.

Scott Lang

Sr. Director, Product Marketing at BeyondTrust

Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Webcasts | February 09, 2021

Customer Webinar: Remote Support 21.1 Released!

Webcasts | February 24, 2021

Your PAM 2021 Blueprint: Securing Privileged Accounts for On-Premises and Cloud Assets

Whitepapers

Evolving Privileged Identity Management (PIM) In The 'Next Normal'

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.