Risk
4/28/2009
06:41 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Federal Reserve IT Analyst Arrest Highlights Internal Threat

I've always had a pick with the trite and hackneyed marketing hype among IT security vendors who repeated the "insiders conduct the most attacks," or "Insiders are the greatest risk." This most recent arrest stokes the debate that was rekindled with the recent release of Verizon Business' 2009 Data Breach Investigations Report.

I've always had a pick with the trite and hackneyed marketing hype among IT security vendors who repeated the "insiders conduct the most attacks," or "Insiders are the greatest risk." This most recent arrest stokes the debate that was rekindled with the recent release of Verizon Business' 2009 Data Breach Investigations Report.In this case, a former worker at the Federal Reserve Bank of New York, along with his brother, were nailed by Federal authorities for allegedly scamming loans with pilfered identities. According to this announcement [PDF] from the U.S. Attorney, Southern District of New York, the suspect was an IT analyst at the bank with access to names, dates-of-birth, and Social Security numbers. Investigators claim to have found a thumb drive with loan applications totaling $73,000 based on stolen identities.

But do cases like this mean the insider is the biggest threat? No, it doesn't. It just means that, in many cases, it may make it easier for insiders to access information because they know where it is, and how it's protected. But as colleague Mike Fratto pointed out in an earlier post, based on Verizon's Data Breach report:

74% of the attacks were from external sources and accounted for 266,788,000 records; 32% from partners accounting for 1,509,000 records; a paltry 20% from insiders accounting for 1,330,000 records; and 39% were from multiple sources accounting for 15,796,000 lost records. On a per breach basis, insiders were responsible on average for more records lost per breach, 100,000, while external sources accounted for a median 37,847, and partners 27,000. Which poses a bigger threat? The most active group, external sources, or the more effective group, internal sources? It doesn't much matter, does it? What this tells me is that information security programs need to focus on protecting information.

Fratto is exactly right. It doesn't (shouldn't) matter where the threat is coming from. Classify your data. Put the proper security controls in place: encryption, access control, monitoring the movement of data, and everything else that goes with a solid security program -- and you're doing what needs to be done to protect your intellectual property, and the safety of your customers.

IT security revolves around protecting the data: whether your adversary is sitting in the cube next to you, or in Kazakhstan.

Follow my security observations on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3586
Published: 2015-04-21
The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2014-5361
Published: 2015-04-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx.

CVE-2014-5370
Published: 2015-04-21
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.18527 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart.

CVE-2014-8111
Published: 2015-04-21
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

CVE-2014-8125
Published: 2015-04-21
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.