Sensitive Data at Risk: Do You Know What to Protect?
User Credentials and Privileged Accounts Named Top Data Targets
BETHESDA, Md., Aug. 28, 2017 /PRNewswire-USNewswire/ -- User credentials and privileged accounts are the most common data types involved in significant breaches, according to results of a new survey to be released by the SANS Institute on September 6, 2017.
"I used to consider data sources such as network and personnel directories as items that need to be protected—although not at the level of 'sensitive' data, such as financial and healthcare records," says Barbara Filkins, SANS Analyst Program Research Director and author of the survey report. "Maybe access information needs even greater protection, given that this survey showed that user credentials and privileged accounts represented the most common data types involved in breaches."
Access information is most sought after because it grants the attackers the same privilege as their victims. They often use this privilege to escalate and spread their attacks, allowing them to gather more types of sensitive information.
Other key data being targeted in significant breaches includes customer financial data, selected by 31% of respondents, and employee data and intellectual property, each chosen by 28%.
Knowing what the attackers are looking for is half the battle.
"When defenders know what attackers want most, they know how to prioritize their efforts," says Benjamin Wright, an expert on the legal aspects of data protection and advisor on this project. "This survey shows how much attackers covet user credentials and privileged accounts."
Understanding how data flows through systems, which is done by less than 4% of our survey sample, is an example of a step defenders can use to aid in both detection and remediation of breaches. Yet 62% indicate that identifying all pathways to their sensitive data is a key challenge.
"Drawing data maps and flows may not be perfect, but the process illustrates a key starting point," continues Filkins. "A picture—or in this case a map—is worth a thousand words in understanding where to start protecting data."
Full results will be shared during a Wednesday, September 6, 2017 webcast at 1 PM EDT, sponsored by Infoblox and McAfee, and hosted by SANS. Register to attend the webcast at www.sans.org/u/vpK
Those who register for the webcast will also receive access to the published results paper developed by SANS Analyst Program Research Director and data protection expert, Barbara Filkins.
Tweet This:
You have sensitive data, and end-to-end data protection hasn't materialized. What can you do? | Register at www.sans.org/u/vpZ
How should you assess and protect your sensitive data? SANS Data Protection Survey Results provide guidance | www.sans.org/u/vpZ
How does your sensitive data protection stand up? Compare your plans to SANS Survey Results | Register at www.sans.org/u/vpZ
About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 50 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates employee qualifications via 30 hands-on, technical certifications in information security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system--the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (www.SANS.org)
SOURCE SANS Institute
Share this article