SALT LAKE CITY, UT — (Marketwire) — 07/28/11 — , the inventor of and market leader in Enterprise Key and Certificate Management (EKCM) solutions, in conjunction with Echelon One, an IT security research leader specializing in security programs and guidance, today released the 2011 IT Security Best Practices Assessment. Echelon One led the effort to establish a set of 12 best practices and worked closely with Venafi to evaluate how well 420 enterprises and government agencies implemented them. The assessment revealed an epidemic of security worst practices, with a majority of organizations failing to adhere to simple data protection standards. In many cases, it revealed that many organizations are critically unaware of what security practices are currently in place.
“The assessment findings were startling. We suspected we would find that many organizations were challenged, but we had no idea that failure rates would run this high,” said Bob West, founder and CEO of Echelon One. “The good news is that with this information and free self assessment, organizations can see where they rank in comparison to peers, and determine where weaknesses exist. They can identify steps to significantly reduce security and compliance risks by leveraging automated processes with multi-layered data security strategies, including managed encryption.”
The assessment evaluated where organizations rank in the implementation of 12 IT security and compliance best practices, ranging from how organizations leverage and manage encryption to how often they conduct security awareness and training programs. The top five best practices, their high failure rates, and recommendations for mitigation include:
Recommendation: Deploy technologies that compensate for lack of training resources by removing opportunities for human error through automation.
Recommendation: Salesforce.com, Google Apps and other cloud applications do not encrypt by default. Deploy third-party technologies that encrypt cloud data — both in motion and at rest — to enhance security, compliance and privacy.
Recommendation: Although the low failure rate seems encouraging, failure to implement management technologies can turn encryption into a liability by exposing keys and certificates that provide unrestricted access to seemingly secure data. Deploy technologies that can manage encryption assets across the entire enterprise.
Recommendation: Digital certificates rank among the most ubiquitous security technologies. However, as recent CA breaches demonstrate, certificate authorities have been and will continue to be compromised. Using a CA is only half the battle — to further reduce risk, have a plan for immediately replacing all certificates and encryption keys generated by the compromised CA.
Recommendation: SSH keys provide servers and their administrators with root-level access to critical systems and data. A key-rotation period that far exceeds the average employee-s lifecycle significantly increases the risk that a former employee or malicious admin can gain unfettered and unauthorized access. Enterprises that do not rotate keys fail to understand their significance and related security vulnerabilities. Deploy technologies that simplify and automate key rotation.
The assessment further revealed that almost 100 percent of evaluated organizations had some degree of security, compliance or operational risk.
When asked if their organizations encrypted data stored in leading public clouds such as Google Apps, Salesforce.com and Dropbox, 40% said they did not know.
When asked how often critical encryption assets such as SSH keys were rotated, 41% responded that they did not know.
When asked if their organizations were using encryption keys and certificates for data security and system authentication, 10% said they were not.
“The biggest security struggle organizations face today is managing the unknown — a.k.a. the unquantified and unmanaged risks. Your best security assets can easily turn into liabilities if not managed properly,” said Jeff Hudson, CEO of Venafi. “If this assessment demonstrates anything, it-s that IT and security departments have got to gain greater visibility over all of their security and compliance activities, and take steps to better understand and manage them.”
The Venafi 2011 IT Security Best Practices Assessment evaluated 420 participant organizations through an independent online survey conducted in July. Sixty percent of the evaluated organizations employ large workforces of 5,000 or more employees. Respondent organizations came from multiple industries, including banking and financial services (27%), high tech (14%), government (11%), and manufacturing (8%).
Questions and best practices baselines were established in conjunction with IT security research firm Echelon One, under the leadership of founder and CEO Bob West. To develop the evaluation and baselines, West drew on his constant interactions with his Fortune 500 customers and his 20-plus years of IT security experience in former positions such as CISO of Fifth Third Bank.
To access the complete assessment and executive summary or to assess your organization, visit: . To take the survey in-person or to discover how to achieve best practices for your organization, visit Venafi at Black Hat USA 2011, August 3 and 4 at Caesars Palace, Las Vegas, NV, Booth 701.
Get social with Venafi on: Facebook: , Twitter: , LinkedIn: , and the Blog:
is the inventor of and market leader in Enterprise Key and Certificate Management (EKCM) solutions. Venafi delivered the first enterprise-class platform to automate the provisioning, discovery, monitoring and management of digital certificates and encryption keys — from the desktop to the datacenter — built specifically for encryption management interoperability across heterogeneous environments. Venafi products reduce the unquantified and unmanaged risks associated with encryption deployments that result in data breaches, security audit failures and unplanned system outages. Venafi also publishes best practices for effective key and certificate management at . Venafi customers include the world-s most prestigious Global 2000 organizations in financial services, insurance, high tech, telecommunications, aerospace, healthcare and retail. Venafi is backed by top-tier venture capital funds, including Foundation Capital, Pelion Venture Partners and Origin Partners. For more information, visit .
Venafi and the Venafi logo are trademarks or registered trademarks of Venafi. All other company and product names may be trademarks or registered trademarks of their respective companies.
Joe Franscella
Trainer Communications
925-271-8213
You must be logged in to post a comment Login