CyberArk: Cybersecurity debt now affecting organisations

Source: CyberArk. Research from CyberArk has uncovered concerns about cybersecurity debt.

A new global report* from CyberArk shows that 82% of Singapore senior security professionals state that cybersecurity has taken a back seat in the last year in favour of accelerating other digital business initiatives. 

The CyberArk 2022 Identity Security Threat Landscape Report identifies how the rise of human and machine identities – often running into the hundreds of thousands per organisation – has driven a buildup of identity-related cybersecurity “debt”, exposing organisations to greater cybersecurity risk. 

Every major IT or digital initiative results in increasing interactions between people, applications and processes, creating large numbers of digital identities. If these digital identities go unmanaged and unsecured, they can represent significant cybersecurity risk: 

- Seventy-four percent of non-humans or bots have access to sensitive data and assets. 

- The average staff member has greater than 28 digital identities**. 

- Machine identities now outweigh human identities by a factor of 27x on average. 

- Eighty-nine percent of local respondents store secrets in multiple places across DevOps environments, while 87% say developers typically have more privileges than necessary for their roles. 

According to the report, digital transformation, cloud migration and attacker innovation are expanding the attack surface. The also identifies current cyberthreats and areas where security teams see elevated risk: 

- Credential access was the No. 1 area of risk for respondents (43% identified it as such), followed by defence evasion (41%), persistence (33%), privilege escalation (32%) and execution (31%)***. 

- Almost 80% of local organisations surveyed have experienced ransomware attacks in the past year: two each on average. Seventy-eight percent of local respondents indicated that their organisation is susceptible to carefully crafted attacks such as a tailored phishing email to an individual with high levels of access. 

- Sixty-nine percent have done nothing to secure their software supply chain after the SolarWinds attack and most (70%) admit a compromise of a software supplier would mean an attack on their organisation could not be stopped. 

Security professionals agree that recent organisation-wide digital initiatives have come at a price: cybersecurity debt, a concept describing how security programs and tools that have grown but not kept pace with what organisations have put in place to drive operations and support growth. This debt has arisen through not properly managing and securing access to sensitive data and assets, and a lack of identity security controls is driving up risk and creating consequences, CyberArk said. The debt is compounded by the recent rise in geopolitical tensions, which have already had direct impact on critical infrastructure.

The situation highlights the need for heightened awareness of the physical consequences of cyberattacks: 

- Eighty-two percent agree that their organisation prioritised maintaining business operations over ensuring robust cybersecurity in the last 12 months. 

- Fewer than half (46%) have identity security controls in place for their business-critical applications. 

Udi Mokady, Founder, Chairman and CEO, CyberArk: “The past few years have seen spending on digital transformation projects skyrocket to meet the demands of changed customer and workforce requirements. The combination of an expanding attack surface, rising numbers of identities, and behind-the-curve investment in cybersecurity - what we call cybersecurity debt - is exposing organisations to even greater risk, which is already elevated by ransomware threats and vulnerabilities across the software supply chain. 

"This threat environment requires a security-first approach to protecting identities, one capable of outpacing attacker innovation.” 

Added Teck Wee Lim, Head of ASEAN, CyberArk: “Even as warnings of cyberthreats such as ransomware and supply chain perpetuate the news, our research has shown that cybersecurity is not a top focus for many organisations. As Singapore eases its COVID-19 restrictions and resumes more economic and social activities, organisations here need to further enhance their cyber resiliency by adopting proactive cybersecurity strategies such as identity security controls based on Zero Trust principles to ensure that both human and machine identities are protected.” 

Next steps, CyberArk suggests, can include:

Push for transparency

Eighty-nine percent say that a software bill of materials would reduce the risk of compromise stemming from the software supply chain. 

Introduce strategies to manage sensitive access 

The top three measures that most CIOs and CISOs who participated in the survey have introduced (or plan to introduce), as cited by respondents are: least-privilege security / Zero Trust principles on infrastructure that runs business-critical applications (64%), eliminating embedded credentials in order to secure passwords, secrets and other credentials used by applications machines and scripts (64%), and real-time monitoring and analysis to audit all privileged session activity (59%).

Prioritise identity security controls to enforce Zero Trust principles 

The top three strategic initiatives to reinforce Zero Trust principles are: workload security; Identity Security tools; and data security. 

Explore:  

Find out more 

*The 2022 CyberArk Identity Security Threat Landscape Report represents the findings of a worldwide survey conducted by Vanson Bourne of 1,750 IT security decision makers, highlighting their experiences over the past year in supporting their organisations’ expanding digital initiatives. Respondents were based in the US, UK, France, Germany, Japan, Italy, Spain, Brazil, Mexico, Israel, Singapore and Australia. 

**Respondents were asked to estimate the number of applications and accounts, on average, accessed per person in their organisation and not managed by federated identities. 

***Respondents were asked about the cyberattacker tactics and techniques (as laid out in the MITRE ATT&CK Matrix for Enterprise covering cloud-based techniques) that represented the most risk to their organisation.