A survey of IT managers shows gaps in access risk management programs, but also reveals that IT managers are very aware of their needs and what they have to do to address them.
When asked to define risks to their organization, the majority of IT managers define their top risks as the potential loss of sensitive data, corporate reputation, intellectual property or revenue. Yet only 12 percent conduct reviews more than monthly to certify that user access poses no risk to those assets. They also struggle with the challenge of identifying what their biggest access risks are and the need to develop and execute processes specifically aimed at managing them. More than 60 percent of IT managers review user access privileges only four times per year or less, and those reviews only ensure companies are observing security and audit best practices. They’re not focused on identifying new or growing areas of access risk from internal users abusing privileges. With internal and external threats to data multiplying quickly, such infrequent reviews aren’t keeping pace with the growth of user access risk levels.
The survey was conducted by Courion Corporation, a provider of identity and access management for access risk.
The survey respondents were keenly aware of the need to do things differently. More than half of the respondents – 52 percent – would like to use near-real-time graphical profiles to help manage the most critical risks to corporate information, but 53 percent of them lack visibility into the access risk management data they need to create such profiles.
Lack of data access also prevents IT managers from identifying associations and patterns of user access that violate company policies, or could enable users to circumvent internal controls. Nearly 60 percent of those polled say they can’t compile the data for that kind of analysis from their existing identity and access management (IAM) systems. Many of those who do use IAM data to manage risk must compile it manually, which is time-consuming and does not provide a business context for evaluating user access risk.
“The survey results show a lot of gaps in access risk management programs, but they also show that IT managers are very aware of their needs and what they have to do to address them,” said Dave Fowler, Courion’s chief operating officer. “Their greatest need is for more intelligence about their access risk – insight into which users have access to what vital information, who they are and what they’re doing with this access.”
Among the survey’s other findings:
- Real-time views of identity and access management activities would help almost 70 percent of respondents identify and monitor potential access risks;
- Fewer than 10 percent feared losing their jobs because of a serious data breach caused by inappropriate user access;
- More than 60 percent cannot review user access privileges to certify that they align with the users’ roles, corporate policies or regulatory requirements.
To review the complete survey results, contact Courion at info@courion.com
