Posted by Mumbai: For most security leaders globally, credential theft remains their top concern. A CyberArk sponsored global survey of 1000 CISOs revealed that attackers are increasingly trying to steal one or more types of credential.
A majority (97%) of these surveyed senior security executives or CISOs say that attackers are increasingly trying to steal one or more types of credentials.
Credential theft continues to remain the top concern for security leaders and CISOs is the fact that organisations are moving to the cloud more than in the past.
As organisations move assets to the cloud, there’s an increase in third-party access to corporate resources and sustained remote work models. Attackers are targeting the non-traditional user populations that may not be adequately protected.
“The CISO View 2021 Survey: Zero Trust and Privileged Access” highlighted that among the CISOs there prevails a consensus on the value of Zero Trust and a growing sense of urgency for securing privileged access.
The survey revealed a marked shift in spear-phishing and impersonation attack patterns:
- The most widely reported group facing increased attacks is end-users – including business users with access to sensitive data. Over half of respondents (56%) say attackers are increasingly targeting such users.
- Attacks are also on the rise against senior leadership (48%), third-party vendors and contractors (39%) and DevOps and cloud engineers (33%).
- A widespread increase in credential theft attempts was reported for personal data (70%) and financial systems and data (66%). This is clear evidence of attackers’ interest in gaining “high-value” access. The includes access to highly sensitive systems that are often held by end-users rather than administrators for example.
In response to these shifting attack patterns, security leaders are embracing Zero Trust models:
- 88% of respondents said adopting more of a Zero Trust approach is “very important” or “important.”
- To implement a Zero Trust model, the top priority was controls focusing on Identity and Access Management (IAM), chosen by 45% of respondents.
- Several types of IAM controls were favoured to protect access to sensitive systems. Just-in-time access controls were highly valued, with 87% of respondents saying reducing standing privileges is an “important” or “very important” aspect of Zero Trust.
Because attackers recognize the value of non-IT identities and are exploiting weaknesses in protecting these identities because of operational challenges, there’s a need for security solutions that work despite internal constraints:
- Endpoint security remains an operational challenge for 94% of respondents – 46% said that installing and maintaining agents made endpoint security is challenging.
- 86% said user experience optimization is “important” or “very important.” Highlighting a need for security tools and policies that will not be bypassed or ignored due to security fatigue.
“The SolarWinds attack and the pace of digital transformation are two factors which have only increased attention on the Zero Trust model in India,” said Rohan Vaidya, Regional Director India – CyberArk.
“Our CISO View report and accompanying survey shares the experiences in implementing the Zero Trust model of Global 1000 security leaders. We believe it will prove to be invaluable guidance for organisations in India that are looking to implement a Zero Trust-based approach to Identity Security,” added Vaidya.
Further, “As new identities multiply across the enterprise – the need to protect privileged credentials, breaking the attack chain to critical data and assets, is acute,” he added.
The survey is a companion to “The CISO View: Protecting Privileged Access in a Zero Trust Model.”
The CISO View in its fifth edition is based on in-depth interviews with a panel of 12 top security executives from global 1000 companies. The panel shared their firsthand experiences around protecting privileged access while transitioning to Zero Trust, including an analysis of risks and recommended controls.