‘Lack of security controls, visibility into user activity put firms at risk’

While the adoption of web applications has brought flexibility and increased productivity, organizations often lag in implementing the security controls necessary to mitigate risk of human error or malicious intent.

The global survey of 900 enterprise security leaders found that 80% of organizations experienced employees misusing or abusing access to business applications in the past year. This comes as 48% of organizations surveyed said they have limited ability to view user logs and audit user activity, leaving a blind spot for catching potentially risky behaviour in user sessions.

According to the research, in 70% of organizations, the average end-user has access to more than 10 business applications, many of which contain high-value data—creating ample opportunity for a malicious actor. In that context, the top-three high-value applications that organizations were most concerned with protecting against unauthorized access were IT service management apps such as ServiceNow, cloud consoles such as Amazon Web Services, Azure and Google Cloud Platform and marketing and sales enablement applications such as Salesforce.

According to the research, 54% of organizations investigate user activity stemming from security incidents or compliance at least weekly vs. 34% of organizations that investigate monthly. Nearly 44% of organizations said they need to enable the same security controls across all applications amid disparate built-in application controls. About 41% of respondents said better visibility into user activity would enable them to identify the source of a security incident more quickly.

“Ensuring security and usability is key. As more high-value data migrates to the cloud, organizations should make certain the proper controls follow suit to manage risk accordingly while enabling their workforce to operate without disruption,” said Gil Rapaport, general manager, Access Management, CyberArk.

“Today, any user can have a certain level of privileged access, making it ever more important that enterprises add security layers to protect the entire workforce as part of a comprehensive Identity Security strategy and Zero Trust framework,” Rapaport added.