Unauthorised apps creating network risks

05 Sep 2012

New survey from Avecto reveals male employees between the ages of 20 and 35 most likely to demand elevated admin rights from IT.

While IT professionals recognise the dangers that unauthorised applications present to network security, most are allowing the threat to go unnoticed, according to a new survey from IT security company Avecto.

It questioned over 1,500 IT professionals attending TechEd North America 2012 in Orlando and TechEd Europe 2012 in Amsterdam, and found that more than one-third (39 percent) have reported a network infection as a result of an unauthorized application being downloaded on their network. In addition, the survey found that more than three-quarters (76 percent) said that they didn’t know how many unauthorised applications have been downloaded on their networks.

According to Avecto’s cofounder and chief operating officer Paul Kenyon, this disconnect suggests that organisations will continue to invite infection to their networks, if they provide excessive administrator rights to users, enabling them to download applications that contain malware.

“The answer is simple – don’t give admin rights out to everyone, only to a few key IT administrators who really need them. You will see an immediate decrease in security risk and associated downtime, as well as an increase in productivity from IT,” he said.

Four-fifths of those surveyed pinpointed male employees, between the ages of 20 and 35, as the most likely to demand elevated rights. “When considered in parallel with other trends blurring boundaries at work, such as BYOD, a troubling trend emerges, in which younger workers have potentially dangerous expectations regarding technology and the workplace,” says Avecto’s report.

These workers, says Kenyon, often come into the enterprise with the same expectations of access and availability that they are accustomed to outside of work. In many instances, he adds, they have the skills and experience to work around basic security protocols to get what they want. On top of this, many IT departments now elevate users to admin rights as a means to shortcut IT support for solving basic problems.

“Considering these factors, it’s more important than ever for organisations to have a solution in place that enables the quick and secure removal of admin rights from users and the ability to deploy policies that elevate all of the legitimate business applications that require privileged access using privilege management technology,” says Kenyon.

At IP EXPO 2012, there’ll be a host of presentations on the subject of IT security, including Richard Hibbert of SureCloud’s seminar, ‘A Practical Guide to IT Risk Assessment’ on Day One (Wednesday 17 October). On Day Two, Niklas Eklov of Splunk will advise attendees to ‘Think Like a Criminal’, in his guide to protecting IT systems against unknown threats.