DATA UNDER ATTACK:2018 GLOBAL DATA RISK REPORTFROM THE VARONIS DATA LAB
58% of companies have over 100,000 folders
open to everyone

CONTENTSSENDING OUT A DATA SECURITY SOS			

3KEY FINDINGS							4ABOUT THE REPORT						5KEY TERMS								5RISK SPOTLIGHTACCESS OVERLOAD					8TICKING TIME BOMB						 11GHOST IN THE MACHINE					 14TOXIC PERMISSIONS						 17SCOPE									6PWNED PASSWORDS						20FIRMOGRAPHICS							7ABOUT VARONIS							23SENDING OUT A DATA SECURITY SOSOrganizations often fail to pay close attention to what goes on before a data breach: the early
warning signs that point to failures in data protection that allow attackers unfettered access toimportant information once they’ve breached a corporate network.
Mapping the millions of unprotected files and folders within an organization serves as a data SOS
that inspires action before the next major breach occurs – it’s a signal that cannot be ignored.
To build this map, we examined Data Risk Assessments performed by Varonis engineers throughout
2017 to gauge the prevalence and severity of exposed critical information and sensitive files, andevaluate what companies are doing (or not doing) to secure their most critical data.

3

KEY FINDINGSDATA AT RISKEXPOSED SENSITIVE FILES

21% of all folders are open to everyone
58% have over 100,000 folders opento everyone

54% of data is stale
34% of users are enabled, but stale

41%
of companies have over 1,000 sensitive files
open to everyone

4KEY TERMSABOUT THE REPORT

Sensitive files contain credit card information, healthrecords, or personal information subject to regulations
like GDPR, HIPAA and PCI.

The 2018 Global Data Risk Report captures findings ofGlobal access indicates files and folders open toData Risk Assessments performed on 130 organizations

everyone (all employees). This data represents the biggest– a representative sample from many industry segments

risk from attack.

and sizes.
Stale data is information no longer needed forEvery year, Varonis performs thousands of Data Risk

daily operations.

Assessments for organizations that want to understandwhere sensitive and classified data reside in their IT

Stale user accounts (aka “ghost users”) are enabledenvironment, learn how much of it is overexposed andaccounts that appear inactive, and often belong to users

vulnerable, and receive recommendations to reduce

who are no longer with the organization.

their risk profile.
Inconsistent permissions occur when folders or files inherit
For this year’s report, Varonis analyzed over 6 billion

extra access control entries from their parents, or fail tofiles, more than double the number in our 2017 report.

inherit access control entries from their parents. Users may
be unintentionally granted or deprived of access.

5SCOPEFiles

6.2 billion files analyzed

Average number of files per TB

1.1 million files

Average number of folders per TB

84,081 folders

Folders459.2 million folders analyzed

Average Folder

The average folder has 13.6 files

Total Data

5.5 petabytes of data analyzed

MedianThe median amount of data
analyzed is 11.1 terabytes

The 2018 Varonis Global Data Risk Report includes data from a random
sampling of 130 companies with all organizational identifiers removed.
For this report, “everyone” includes every employee within the organization.
All calculations are based on averages unless otherwise indicated.

6FIRMOGRAPHICSOverexposed data presents a major risk to organizations regardless of size, industry or location.
This report encompasses Data Risk Assessments performed in more than 50 countries andacross 30+ industries including insurance, financial services, healthcare, pharma and biotech,
manufacturing, retail, utilities and energy, construction, IT and computer software, education,local, state and regional governments.

7

RISK SPOTLIGHT

ACCESS OVERLOAD
Attackers look for unsecured folders as soon as theyland on a network, and folders open to global access

88%

groups – Everyone, Domain Users, or Authenticated
Users – give them easy access to business plans,
intellectual property, customer and employee data,credit card information, and more. Files open to anyone
via an anonymous link represent additional risk.
Globally accessible data puts organizations at risk frommalware and ransomware attacks: it takes just oneof companies with over 1 million folders
have over 100,000 folders open toeveryone.

click on a phishing email to set off a chain reaction thatencrypts or destroys all accessible files.
Regulations like the EU General Data Protection
Regulation (GDPR) set the stage to penalize companies
that fail to protect personal information that often
resides in unsecured files and folders.

8ACCESS OVERLOAD: FAST FACTS

OPEN ACCESS

30% of companies have over 1,000
sensitive folders open to everyone

41% of companies have over 1,000
sensitive files open to everyone

88% of companies with over 1 million

58%

folders have over 100,000 folders open
to everyone

21% of all folders in a companyof companies have over 100,000 folders
open to everyone

are open to everyone

9BEST PRACTICE CHECKLISTBEST PRACTICE CHECKLISTACCESS OVERLOAD

Global groups - including Everyone, Domain Users, and

Identify and remediate global access groups that
grant access to sensitive and critical data
Ensure that only appropriate users retain access tosensitive, regulated data

Authenticated Users - allow everyone in an organizationto access these folders.
IT professionals estimate it takes about 8-6 hours

for any data containers (folders, mailboxes,per folder to locate and manually remove global access

SharePoint sites, etc.) with global access groups

groups: they must identify users that need access, create

applied to their ACLs

and apply new groups, and populate them with theright users.

Routinely run a full audit of your servers, looking

Replace global access groups with tightly managed
security groups

To achieve least privilege, it’s critical to restrict access to
only those who need it: manage users, eliminate broken
inheritance and permissions inconsistencies, and lockdown sensitive data.

Start with the most sensitive data and test changes
to ensure issues do not arise

10

RISK SPOTLIGHTTICKING TIME BOMB
Sensitive stale data includes critical information about
employees, customers, projects, clients, or otherbusiness-sensitive content.

54%
of a company’s data isstaleThis data is often subject to regulation including
SOX, HIPAA, PCI, and GDPR – and data kept beyonda pre-determined retention period can expose anorganization to additional liability.
Stale data can be expensive to store and manage, andposes an increased (and unnecessary) security risk.

74%
of companies have over 1,000
stale sensitive files
11TICKING TIME BOMB: FAST FACTS

STALE DATA

54% of a company’s data is stale76% of folders in a company
contain stale data

74% of companies have over 1,000

76%

stale sensitive files

61% of companies have over 5,000
stale sensitive files

In companies that have over 1 million folders,approximately 76% contain stale data

85% of companies have over 100,000
folders that contain stale data12

BEST PRACTICE CHECKLISTBEST PRACTICE CHECKLISTTICKING TIME BOMB

Follow the principles of Privacy by Design:

Minimize the sensitive data you collect

While organizations focus on keeping attackers out, all

Minimize who gets to see it

too often the data itself remains widely accessible and

Minimize how long you keep it

unmonitored. That’s like putting all your defenses andresources into building the strongest, highest castle walls,

Identify stale data – especially sensitive information

Archive or delete stale data if no longer needed

but leaving your crown jewels draped on the coat rack
beside the front door.
Stale data quickly becomes a security liability andunnecessary storage expense. In order to reduce risk, it’s
important to identify stale data and determine what data
can be moved, archived, or deleted - and to establish
consistent policy to manage stale data moving forward.

13RISK SPOTLIGHT

GHOST IN THE MACHINE
Hackers, like burglars, often look for the easiest andquietest ways to get in and move around. User and service

65%

accounts that are inactive and enabled (aka “ghost users”)
are targets for penetration and lateral movement.
Ghost user accounts can lie dormant, going unnoticed
day to day, yet still provide access to systems and data.
Stale, but still enabled, user accounts are a great way forhackers to test the waters. Stale user accounts that are noof companies have over
1,000 stale user accounts

longer active create noise that can make security moredifficult for organizations.
Hunting and eliminating ghost users is a security steporganizations often overlook. If these accounts are left
unmonitored, attackers can steal data or cause disruption
without being detected - placing your organization at risk.

14

GHOST IN THE MACHINE: FAST FACTS

STALE USER ACCOUNTS

34% of users are enabled but stale
64% of user accounts are stale
65% of companies have over 1,000

46%stale user accountsof companies have over 1,000
enabled but stale users

15

BEST PRACTICE CHECKLISTBEST PRACTICE CHECKLISTGHOST IN THE MACHINE

Outdated user permissions and stale accounts are a target

Make sure stale accounts are disabled and monitored
for re-enablement and activity, or deleted
Implement procedures to ensure that all user accounts
are active, governed and monitored

for exploitation and malicious use. Most attackers target
data, but they reach their target by hijacking accounts.
Users with unnecessary access to sensitive data representuser and service accounts so you can better spothigh risk to the company – and stale but enabled accounts

inactive users and behavioral anomalies

are an unnecessary security risk.
Review stale enabled accounts to determine if they arenecessary, and delete or disable accounts as needed.

Understand what constitutes normal behavior on both

Boost your organization’s anomaly detection
capabilities and response processes

16

RISK SPOTLIGHTTOXIC PERMISSIONS
Access requirements change over time as projects andteams come and go, and users join, change roles, or leave
the organization.

49%of companies have over 10,000
folders with unresolved SIDS

It is important to know exactly who uses – and no longer
uses – data to be surgical about reducing access withoutcausing any headaches.

57%of companies have over 1,000
folders with inconsistentpermissions
17TOXIC PERMISSIONS: FAST FACTSDATA AT RISK

1 TB contains 84,081 folders
1 TB contains 1.1 million files
12% of a company’s folders are

3%

uniquely permissioned

10% of users have removal

recommendations, and are likely to havemore access to data than they requireof a company’s folders are protected(not inheriting permissions)18

BEST PRACTICE CHECKLISTBEST PRACTICE CHECKLISTTOXIC PERMISSIONS

Simplify access management procedures andstandards help lock down potential exposure ofsensitive data from insider threats

The more complex a file system structure, the greater risk
for overexposure and security vulnerabilities.

Decrease the amount of data any compromised
account can access, making an attackers’ target that

Update data and access in order to maintain a securemuch harder to reachenvironment, ensure resources are used efficiently, andclose security loopholes that might otherwise be exploitedor become vulnerable to brute-force attacks.

Work to attain and sustain a “least privilege model,”where users have access to only the data they need.

To do so:Eliminate global access

Simplify permissions structures

Ensure that all data has an owner or stewardPeriodically recertify access to data tospot those that have changed jobs or left
the organizationUse automation to discover accounts thatlook like they may have access to data they
don’t require
19

RISK SPOTLIGHTPWNED PASSWORDSVery few (if any) accounts should have passwords thatnever expire. Users with non-expiring passwords give65%

attackers a large window to crack them using bruteforce. Once breached, they provide indefinite access todata. Passwords that aren’t rotated also have a higher
likelihood of showing up in breached password dumps.
Administrative accounts with non-expiring passwords are
an attacker’s best friend.

of companies have over 500 users
with passwords that never expire

The most common reason users change their passwords
is because they’ve forgotten them. Half of people
surveyed cited this as the most common reason to changea password. In contrast, despite the increasing amount ofhacks in the news cycle, only 1 in 5 Americans said theychange their password as a result of a hack in the news.

20

PWNED PASSWORDS: FAST FACTS

EXPIRED PASSWORDS

14% of enabled users have expired
passwords

46% of companies have over 1,000

10%

users with passwords that never expire

65% of companies have over 500

users with passwords that never expireof users have a password thatnever expires

21

BEST PRACTICE CHECKLISTBEST PRACTICE CHECKLISTPWNED PASSWORDS

Set expiration dates for user account passwords

Enforce password length and complexity
requirements

Use multi-factor authentication wherever possible

Monitor login activity and account lockouts to spot
potential attacks



Enforce Password History to discourage users fromalternating between several common passwords

IT must disable non-expiring passwords and set passwords
for all users to expire at set intervals. If an account requiresa static password, make sure it is extremely long, complex
and random to help protect from brute-force attacks.
The use of enterprise-wide password managers, two-factor
authentication, and monitoring and alerting on suspicious
failed login attempts are also great ways to mitigate
attacks that stem from poor password practices.

22

WHAT VARONIS CUSTOMERS ARE SAYINGABOUT VARONIS

Varonis has been a huge help for mycompany with various projects, and crucialfor GDPR. Also has enable(d) us to automate

Varonis is a pioneer in data security and analytics,
specializing in software for data security, governance,compliance, classification, and analytics. Varonis detects

some of our manual processes.
- UK-based financial company

insider threats and cyberattacks by analyzing file activity
and user behavior; prevents disaster by locking downsensitive data; and efficiently sustains a secure statewith automation.

Varonis has given us much needed
insight into our network and environment
we never had before.

Live Demo

Data Risk Assessment

Set up Varonis in yourown environment. Fastand hassle free.ect yo

Get a snapshot of your data
security, reduce your risk profile,and fix real security issues.

info.varonis.com/demo

info.varonis.com/start- IT administrator, healthcare organization