Endpoint
11/1/2010
05:26 PM
Connect Directly
RSS
E-Mail
50%
50%

Tackling Insider Fraud From The Outside-In

Companies should use the same technologies that authenticate external customers to monitor employees and watch for insider attacks

IT managers spend a lot of their time dealing with malicious code and violations of corporate policy, but insider fraud in the workplace is a major problem that frequently shows up on their radar screen, as well.

In 2009, the average company lost nearly 5 percent of its revenue to fraud perpetrated by employees, according to the 2010 Report to the Nations on Occupational Fraud and Abuse (PDF). Asset fraud -- stealing company resources -- represented 90 percent of the incidents, but only averaged $135,000 in losses per company. On the other hand, financial fraud makes up only 5 percent of all cases of corporate fraud, but it is the most damaging, with a median loss of more than $4 million, according to the report, which is published every two years by the Association of Certified Fraud Examiners (ACFE).

Employees can be tempted by their privileged access to data, says Ben Knieff, director of product marketing for fraud products at Actimize. "They have a high level of access, which gives them a greater opportunity to commit fraud," he says.

The report found that 85 percent of fraud was committed by individuals with no prior records of abuse. Even so, there are a number of proactive steps that companies can take.

Limit Access To Critical Data
Data is difficult to tame. Companies that attempt to control the flow of information inside the company could be setting themselves up for failure, says Shane Sims, director at PricewaterhouseCoopers' forensic practice.

"Data has leaked out everywhere. It is not in the central locations like [companies] think it is," he says. "People have exported it; it is on user systems and in data warehouses and on share points. So to me, tackling the insider threats starts with understanding what kind of data you have and where it is."

Even if companies cannot successfully control the movement of data inside their networks, finding out which employees are accessing the most important data can be enough to prevent the most significant potential fraud, he says.

"Continually do background checks for the high-risk people that have access to the crown jewels," Sims says. "The economic downturn has created the most fertile fields for insider fraud."

Use The Inside Advantage
Companies should not treat external attacks and internal fraud as two different problems. They need to deal with insiders in the same way they deal with external fraud, Actimize's Knieff says. While insiders have an advantage in terms of knowing the network and corporate policies, companies can also collect a great deal of information that would not be available outside the network.

"Because it is an insider, an institution has a chance to deal with the problem with more information than you would normally have with external fraud," Knieff says.

Background checks, monitoring employee usage of assets, and other intelligence can be used to find hints of whether a worker has turned or could turn rogue.

"An employee might be a star employee for a long time, and he may have some life-changing event away from work -- you have to look for spikes in behavior," he says.

Tap Your Employees
Employees can be a big benefit to companies in detecting malicious behavior by other employees.

In about 40 percent of cases, insider fraud was flagged by a third party, and half of those tips were made by an employee, according to the ACFE report. Customer complaints represented about 18 percent of tips. In many cases, signs of the fraudster's actions are evident. The study found 43 percent of perpetrators are living beyond their means and more than a third of fraudsters have had financial problems.

The statistics should underscore that companies should not rely on any particular technology, says Rich Baich, principal with Deloitte's security and privacy practice. "The real power is in the collaboration and integration of the information created by [security] products, when combined with internal information," he says. "You have to have some technologies in the place. But if you really think there is a technology today [that can solve your problems], the bad guys will find a way around it."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio