A survey of 900 information technology professionals found almost half of
enterprise help desks have gaps in security controls and training that could
help ward off attacks like social-engineering assaults.
The SANS 2013 Help Desk Security and Privacy Survey published this week indicated the main jobs of help desk agents were to field requests from employees and others related to computer incidents, password-reset requests or personal information. Helpdesk agents "are trained to be friendly and get as many calls completed, resolved or transferred as possible," the survey notes. But a third of the IT professionals responding in the survey acknowledged they had "weak" risk management and security awareness training for their help desk staff, while 5% had "none" and 6.0 "didn't know."
Seventy percent of the survey respondents acknowledged "social engineering" attacks in which someone tries to get sensitive information or passwords from helpdesk agents as a significant risk. Helpdesk agents, who may have access to sensitive corporate resources, tend to be rated on productivity and speed metrics, the survey said, often meaning help desk agents are under pressure to work quickly. And help desks are often understaffed.
"As a result, an agent may ignore or work around compliance or quality requirements by trying too hard to meet the goals for quantity and timeliness," the SANS report states. The report also notes that entry-level-position helpdesk agents aren't particularly well-paid and there's a lot of "churn" in job changes, with annual turnover rates of 30% to 40% being common.
The SANS report said IT professionals related several types of problems they see in their help desk operations, such as personal health information inadvertently ending up in help desk system databases because a customer and help desk agents were e-mailing it back and forth.
In terms of budgeting for security, help desk operations are simply often overlooked, the SANS report said. Almost half did have some kind of training provided directly by managers and supervisors and much less often, automated help desk staff training, whether via internal tools or service providers.
Automation of help desk operations in general remains fairly low. Less than half also said they use some kind of automated user-authentication tools and authorisation tools. The help desk remains "far from the most critical line item on the corporate budget," the SANS report notes. About a quarter of the IT professionals responding to the SANS survey said they took into consideration what it might cost to have a security incident occurring -- such as a user password being compromised -- when establishing the help desk budget, but the majority did not.
"Effective help desks operations are as much a security problem as they are anything else, but it's a problem that falls through many cracks because the risks are hard to quantify and resolve," the SANS survey report concludes.
The SANS 2013 Help Desk Security and Privacy Survey published this week indicated the main jobs of help desk agents were to field requests from employees and others related to computer incidents, password-reset requests or personal information. Helpdesk agents "are trained to be friendly and get as many calls completed, resolved or transferred as possible," the survey notes. But a third of the IT professionals responding in the survey acknowledged they had "weak" risk management and security awareness training for their help desk staff, while 5% had "none" and 6.0 "didn't know."
Seventy percent of the survey respondents acknowledged "social engineering" attacks in which someone tries to get sensitive information or passwords from helpdesk agents as a significant risk. Helpdesk agents, who may have access to sensitive corporate resources, tend to be rated on productivity and speed metrics, the survey said, often meaning help desk agents are under pressure to work quickly. And help desks are often understaffed.
"As a result, an agent may ignore or work around compliance or quality requirements by trying too hard to meet the goals for quantity and timeliness," the SANS report states. The report also notes that entry-level-position helpdesk agents aren't particularly well-paid and there's a lot of "churn" in job changes, with annual turnover rates of 30% to 40% being common.
The SANS report said IT professionals related several types of problems they see in their help desk operations, such as personal health information inadvertently ending up in help desk system databases because a customer and help desk agents were e-mailing it back and forth.
In terms of budgeting for security, help desk operations are simply often overlooked, the SANS report said. Almost half did have some kind of training provided directly by managers and supervisors and much less often, automated help desk staff training, whether via internal tools or service providers.
Automation of help desk operations in general remains fairly low. Less than half also said they use some kind of automated user-authentication tools and authorisation tools. The help desk remains "far from the most critical line item on the corporate budget," the SANS report notes. About a quarter of the IT professionals responding to the SANS survey said they took into consideration what it might cost to have a security incident occurring -- such as a user password being compromised -- when establishing the help desk budget, but the majority did not.
"Effective help desks operations are as much a security problem as they are anything else, but it's a problem that falls through many cracks because the risks are hard to quantify and resolve," the SANS survey report concludes.
