Almost Half of Employees Have Access To More Data Than They Need (betanews.com) 53
A new study of over 700 full-time US employees reveals that that 48 percent of employees have access to more company data than they need to perform their jobs, while 12 percent of employees say they have access to all company data. From a report: The survey by business app marketplace GetApp also asked employees what classifications of data protection are in place at their company. No more than a third of businesses were found to use any one individual data classification. The lowest in use are Proprietary (15 percent) and Highly Confidential (18 percent). The most commonly used are Confidential -- 33 percent of businesses use this classification, Internal -- 30 percent, Public -- 29 percent and Restricted/Sensitive -- 25 percent.
More than 12%... (Score:2)
... actually have access to all the company data but just don't know it.
Re: (Score:2)
Incomplete picture (Score:3, Interesting)
People may have access to data they don't need to see for many legitimate reasons.
Here's a common one:
The employee may belong to a work-group where they may need to back-fill a sick co-worker, and their jobs are so similar that it's safe to give them both access to the same set of data. For example, I may be in charge of helping customers whose last names start with A-M and my co-worker those whose names start with N-Z. But if I'm covering for her, suddenly the "needs of my job" change. Is my manager going to call IT just so I can back-fill for one day? No, he's going to give us both access to all customers' data.
I'm sure people can think of other reasons.
Rather than ask "how many people have access to data they don't really need" ask "which employees have access to what data, how does that benefit the company, what are the risks involved, and what accountability is there such as training, logging, and the like in case data winds up outside the company or work-group when it shouldn't."
Re: (Score:1)
Rather than ask "how many people have access to data they don't really need" ask "which employees have access to what data, how does that benefit the company, what are the risks involved, and what accountability is there such as training, logging, and the like in case data winds up outside the company or work-group when it shouldn't."
I'm pretty sure that gets taught as part of generic database management and installation, at least it's in textbooks. But what seems more worrisome is that 12% that can see all data. What company would need 1 in every 8 employees to have access to everything?
Re: (Score:2)
Is this self-reported?
I'd be surprised if 12% of employees understood a business's infrastructure well enough to identify "everything" as distinct from "everything they see".
Re: (Score:2)
The company I work at currently. We have 9 full time employees and a contractor to do IT. The owner and her husband definitely both have full access to everything, and the engineering manager does too. I'm sure the contracted IT guy could see anything he wanted to, also.
The one person who should not have full access is the owner. She frequently clicks on malicious links and a couple of times has needed her computer rescued.
Granularity of data also applies (Score:1)
People may have access to data they don't need to see for many legitimate reasons.
I'd argue that one of the reasons could well be that it's just too much work most of the time.
Now, as we've seen with ransomware, nobody should have access to everything, but at an extreme example we could have access controls active at the file level, and at the row level in databases. But we'd get nothing done, on average, so much work would happen granting and revoking permission.
So you see some deals where, such as in the medical field, where you have access to darn near anything - but access is logged
Re: (Score:2)
Re: (Score:3)
I am a report and analysis developer using BI solutions to provide them. I definitely have access to tons of data I don't need to see, because I am not using any of that data in a business sense. Also, there are data sources I used once or twice to generate business analyses, then never needed to work with again, but the access was kept in case it's needed again. There was an attempt a few years ago to provide us (report developers) with garbage data samples but that didn't work because of a variety of good
12% seems high... (Score:2)
Re: (Score:2)
"I can access the C: drive, what else is there? Yes, I can access everything."
Who cares? (Score:4, Interesting)
Re: (Score:1)
old software / not paying for updates / no failove (Score:2)
old software / not paying for updates / no fail over (so you can't get downtime to update)
Re: (Score:2)
Sending emails in plain text. Storing SSH keys on shared drives or vaults with access to inappropriate personnel. Leaving obsolete logins in place. Improperly secured backups, including backup tapes, disk images in the cloud, and credentials stored in source control. Using HTTP or FTP for _anything_.
The list of vulnerabilities goes on and on in many environments.
Re: (Score:2)
And the funny thing is, this data is how I grew my business because of how completely lack luster security is at many businesses, including my competitors. Once I found out the numbers, the rest was easy, especially when I find out companies are making huge HUGE margins while they run ancient machines with illegal aliens as operators.
Re: (Score:2)
Make the fines huge and have them distributed to the victims. When people start getting notifications and cheques they will care. They will demand the highest standards and a strong regulator to oversee them.
Re: (Score:2)
It's a chicken and egg problem. You won't generate the political will to impose those huge fines until people care. But people won't care until they start getting those checks.
Re: (Score:2)
Maybe some populist can get the crowd to chant "make them pay" for a change.
Re: (Score:2)
Won't catch on. The whole thing is too abstract, with no compelling storylines. You can't whip up crowd emotions with something liek this.
Re: (Score:1)
How about 'less than they need'? (Score:4, Funny)
Re: How about 'less than they need'? (Score:3)
Meanwhile the DBA is a hired consultant.
More like almost 99% (Score:2)
Almost everywhere I go there is more access than necessary for just about everyone. Employees are not security conscious no matter how many times your try to brow beat the idea of security into them. If you are not using and semi advanced technological mechanisms to keep access to data secure then you are probably already compromised multiple times and are just not aware of having been compromised.
Conversely the 12% having access to all of the data is likely overblown, unless we are only talking about 12%
Re: More like almost 99% (Score:3)
Don't forget that 90% of the data a company has is old data that's pretty uninteresting for anyone else except if the IRS does a review or you get a claim. There's also a pile of old projects that are saved on different systems that comes in handy when the customer comes back several years later due to a hardware or OS upgrade. But you don't know which customer so just let the stuff hang around on a project disk.
Erasing old data is a sure way of getting a call frommthat customer a month later.
Missing Qualification ... (Score:3, Informative)
A far better survey would be (Score:4, Insightful)
what number of contractors (on-site and off-shore) have access to more data than they need?
People who may tend to be able to access more, think DBA's and SA's who need access to the system or the databases for routine work. Programmers need access to test and QA systems, but probably never to production systems with valid production data.
The employees who tend to have way more access than they need would be people like administrative assistants, and managers, who can't be bothered to ask for access, they just need it, so they force someone to grant them access.
That is of course assuming that data classification is actually being done...
Re: (Score:2)
This whole thing reminds me of when the shit hit the fan with Snowden. The big brass officials were all over the place denying it because this Snowden guy was just some lowly System Administrator and wouldn't have all that access. Anyone that knew anything about IT at that point knew the leaks were for real.
Just badly planned (Score:2)
At my job I work with software which doesn't let me see full bank accounts.
I work at a bank and I definitely need that. (I'm forced to look it up in a second system - which logically I shoud not have acces to.)
Re: (Score:1)
which logically I should not have access to.
Why's that?
Re: (Score:2)
Since he's denied access in the first system, it would only be logical if he were denied access in the second system.
Re: (Score:2)
System one *has* the information I need, it simply won't show it because the UI designer didn't understand how things work in real life.
System two has lots of information that I don't need, therefore having access is a bad thing.
Lose access when transitioning (Score:1)
I would like companies to remove access for employees when they switch departments. Sure, it's convenient if Joe can still log into a management console to fix a VM, he's got the knowledge and need.
But Joe's not hip to what the rest of his old team is doing now. Maybe there's something additional he should be doing when fixing a VM.
Honestly, I'd like a bucket for each employee. When an employee gains access to something, the person granting them access, tosses a note in that bucket on what access was grante
Re: (Score:1)
Seems to me that a company which takes Access Control seriously already does this ... and no "buckets" are required. I used to work for a company that did this (actually, I have never worked anywhere that did not). All access permissions were required to be audited (reviewed and re-approval recorded) by the Owner (of whatever the access covered) on a recurrent schedule determined by the risk associated with the permission. And all incumbents to an Owner role had to review and sign off on all existing acc
Re: (Score:2)
Because most places don't have competent people. Policies get implemented and doesn't change for the better, but gets worse over time. Then there is the nuisance crying, which ends up degrading this system even more, especially with companies who have a carousel of employees that come in and out, that the boss gets tired of paying an IT guy to help manage the system.
I've been to places where the top executive logins and passwords were just their first name, so had access to completely everything, despite ac
Often: Too much is better than too little. (Score:2)
If they have more access than they need to do their job, they may be a security risk, but they can get their job done.
If they have less access than they need to do their job, the job doesn't get done or doesn't get done right.
Which is more critical to a company's day-to-day survival and profitability? Which "error" costs the company more on the bottom line? Which can be "fixed" with insurance, rather than just breaking the company right now?
If the employee isn't trustworthy with the data, why was he hired
Re: (Score:1)
Re: (Score:1)
to meny add / services need to full admin rights (Score:2)
To many add / services need to give full admin rights to people to only do a few things.
Some apps don't have real service accounts (no needs linked an full user to do some tasks) (so they can be come shared or you need to give full admin to a few people so they can take over an account) as tieing to 1 live user is bad as well.
ldap admins more or less then give them self admin rights to any app that is grouped controlled.
Other you need to have an full admin that is local to the app to do some things like edi
Tried to address this, managers won't listen (Score:3)
At work many years back I tried to address this, specifically within the IT department itself. Everyone in the department had full write access to everything. I felt this was a mistake, and that key staff within each section of the department should have full write. Selected telecom infrastructure staff should be able to update maps and other cabling documentation, even if everyone is free to read. Print services staff should be able to add remove printer drivers, software/windows development staff should have the right to update most other drivers, etc, etc, etc.
Boss at the time decided nope, full read/write for everyone. Helpdesk could edit cable plant files, cable infrastructure folks could delete device drivers. Thing is, once the permissions are set up badly no one wants to fix them because it means everyone's procedures now have to be revised. That idiot boss basically set the organization on a path that no one will be willing to deviate from.
Re: (Score:2)
More than half the people dont have enough access (Score:4, Informative)
Since its highly unlikely in a complex and ever changing environment that you have access to exactly the data you need to do your job especially since the job is different everyday for knowledge workers by definition statistically speaking half will have too little access and half will have too much access.
Re:More than half the people dont have enough acce (Score:4, Funny)
Yeah. But what's the cost to the organization of not having data that you need versus having access to data that you don't?
Some years ago, I was part of a team that built an engineering data control system. Only certain people had permission to create or modify the data. But anyone with permission to log on to the internal company network could read anything that they wanted. We did log read access, so anyone attempting industrial espionage could be traced. The system worked well.
Then, management decided to replace our system with one that had a much finer access control. The result was that shop floor employees now had to chase down various domain access managers to obtain access that might not have been granted (in error) or became necessary due to some unusual configuration issues. (Wire bundle routed through an air conditioning duct. Let's bring up a drawing of both.) The shop floor pretty rapidly devolved into a shit-show. But management's answer was to hire a bunch of 'liaison engineers' who had greater access and could resolve problems. Productivity never recovered to that of the previous system. Manpower expense was higher and when problems arose, time was still wasted locating one of these engineers. When things were running smoothly, I suspect they spent their time surfing porn or shitposting on Slashdot.
Re: (Score:2)
At my previous job, I often wrote proposals for projects with a client that I knew from another job. One of my bosses had gotten me permissions to access proposals because he knew I had a good relationship with that client. Then, someone decided that employees with my my job title didn't need access to proposals, and I lost access. Though they restored my access at first, they eventually woul
Training... (Score:2)
... I remember my former security employer had a required online training about this. Basically, it said the contractors and employees must not look at stuff that they shouldn't be looking at if unrelated to them. Ha!
Damn! (Score:2)
I really didn't need to know that.
Seems off.... (Score:1)
I bet that in the IT sector that number is low. (Score:4, Informative)
Re: (Score:1)
Expensive to figure out what accessis needed (Score:2)
It takes real effort to figure out what access each employee needs to do their job, and if insufficient access is provided, there is the expense of lost time while the employee is given the extra access that they need.
Its a matter of cost vs risk tradeoff.
I've seen the reverse problem, it's much worse. (Score:1)
I worked for a place that was overly concerned with protecting it's IP, often IP that was of limited or no value. While companies may give too much access, too tightly controlling access creates much bigger problems. Trying to do your job when each tiny snippet of information requires several days to several weeks of effort and explanation with multiple levels of management is simply not productive.
IMHO, the correct solution is to have reasonable restrictions on information which means that managers have
Operational Realities vs. Security Risk (Score:2)
I work in operations and, being a public institution, we spend as little money as possible. Thus, we run lean. I had to let one of my staff go in April. I'm still trying to hire for the position. I have combined his data permissions with mine so I can do his old job while I try to hire for it.
My director retired in June. I now have access to a lot of his old stuff along with the 2 others in the management team.
These are all good reasons for me to have the expanded access I do, but what happens when those jo
another metric (Score:1)