CyberArk Report Also Finds Agility and Automation Initiatives May Lead to ‘Credential Creep’ and Increased Privilege-Related Risk
NEWTON, Mass. & PETACH TIKVA, Israel–(BUSINESS WIRE)–According to a new global survey from CyberArk (NASDAQ: CYBR), 50 percent of organizations believe attackers can infiltrate their networks each time they try. As organizations increase investments in automation and agility, a general lack of awareness about the existence of privileged credentials – across DevOps, robotic process automation (RPA) and in the cloud – is compounding risk.
According to the CyberArk Global Advanced Threat Landscape 2019 Report, less than half of organizations have a privileged access security strategy in place for DevOps, IoT, RPA and other technologies that are foundational to digital initiatives. This creates a perfect opportunity for attackers to exploit legitimate privileged access to move laterally across a network to conduct reconnaissance and progress their mission.
Preventing this lateral movement is a key reason why organizations are mapping security investments against key mitigation points along the cyber kill chain, with 28 percent of total planned security spend in the next two years focused on stopping privilege escalation and lateral movement.
Security Barriers to Digital Transformation and the Privilege Priority
The survey found that while organizations view privileged access security as a core component of an effective cybersecurity program, this understanding has not yet translated to action for protecting foundational digital transformation technologies.
“Organizations are showing increasing understanding of the importance of mitigation along the cyber kill chain and why preventing credential creep and lateral movement is critical to security,” said Adam Bosnian, executive vice president, global business development, CyberArk. “But this awareness must extend to consistently implementing proactive cybersecurity strategies across all modern infrastructure and applications, specifically reducing privilege-related risk in order to recognize tangible business value from digital transformation initiatives.”
Global Compliance Readiness
According to the survey, a surprising 41 percent of organizations would be willing to pay fines for non-compliance with major regulations, but would not change security policies even after experiencing a successful cyber attack. On the heels of more than $300M in General Data Protection Regulation (GDPR) fines being levied on global organizations for data breaches, this mindset is not sustainable.
About the CyberArk Advanced Threat Landscape 2019 Report
The CyberArk Global Advanced Threat Landscape 2019 annual report is the 12th in the series. The survey was conducted by Vanson Bourne among 1,000 IT security decision makers and C-level executives across seven countries worldwide: the US, UK, France, Germany, Israel, Singapore and Australia. To download a copy of the report, please visit: http://www.cyberark.com/TL19
Read more at Business Wire.