New research from the leader in privilege management, Avecto, found that more than 50 percent of IT professionals admit to providing their employees with local administrative privileges on Windows computers, despite the associated security threats. Of the 500 IT and security professionals surveyed across North America and Europe, a quarter were unsure about which users within their organization have been assigned local admin privileges.
According to the results, the number of U.S. companies providing employees with admin rights rose to 70 percent. Furthermore, the number of IT managers in the U.S. that do not know which users have these rights rose to over 20 percent. The data suggests that European businesses have slightly more control over admin rights, with 40 percent admitting to the use of local admin privileges. However, almost 20 percent of the U.K. IT managers are still not confident in their visibility over who has these privileges.
"These findings show that many companies are still not putting appropriate measures in place to counter the threat of admin rights," said Andrew Avanessian, chief operating officer at Avecto. "This is such a massive mistake, because unnecessary admin privileges increase the risk of sensitive and business-critical data being deleted or shared - even accidentally."
The perception many companies have is that it’s extremely difficult to remove admin rights and time consuming to maintain the resulting environment. According to a report by Gartner, “the common misconception is that a user with local admin rights can do little harm and that administrative actions taken at the endpoint are isolated to the endpoint itself. Neither assertion is true." Gartner, Inc., "Reduce Access to Windows Local Administrator with Endpoint Privilege Management," Lori Robinson, October 20, 2017.
Avanessian continued, “Many of 2017's most famous data breaches including WannaCry and NotPetya could have been mitigated if basic controls such as privilege management and application control were in place to stop the attack from launching and spreading. The right technology, which is often simple to implement, means organizations no longer need to compromise - you can ensure that employees have what they need to perform their role while safeguarding the business from attacks."
For more information on a quick and effective implementation to remove admin rights, head to the Avecto website for a product demo.
Click here to view the full infographic >
