Endpoint
11/1/2010
05:26 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Tackling Insider Fraud From The Outside-In

Companies should use the same technologies that authenticate external customers to monitor employees and watch for insider attacks

IT managers spend a lot of their time dealing with malicious code and violations of corporate policy, but insider fraud in the workplace is a major problem that frequently shows up on their radar screen, as well.

In 2009, the average company lost nearly 5 percent of its revenue to fraud perpetrated by employees, according to the 2010 Report to the Nations on Occupational Fraud and Abuse (PDF). Asset fraud -- stealing company resources -- represented 90 percent of the incidents, but only averaged $135,000 in losses per company. On the other hand, financial fraud makes up only 5 percent of all cases of corporate fraud, but it is the most damaging, with a median loss of more than $4 million, according to the report, which is published every two years by the Association of Certified Fraud Examiners (ACFE).

Employees can be tempted by their privileged access to data, says Ben Knieff, director of product marketing for fraud products at Actimize. "They have a high level of access, which gives them a greater opportunity to commit fraud," he says.

The report found that 85 percent of fraud was committed by individuals with no prior records of abuse. Even so, there are a number of proactive steps that companies can take.

Limit Access To Critical Data
Data is difficult to tame. Companies that attempt to control the flow of information inside the company could be setting themselves up for failure, says Shane Sims, director at PricewaterhouseCoopers' forensic practice.

"Data has leaked out everywhere. It is not in the central locations like [companies] think it is," he says. "People have exported it; it is on user systems and in data warehouses and on share points. So to me, tackling the insider threats starts with understanding what kind of data you have and where it is."

Even if companies cannot successfully control the movement of data inside their networks, finding out which employees are accessing the most important data can be enough to prevent the most significant potential fraud, he says.

"Continually do background checks for the high-risk people that have access to the crown jewels," Sims says. "The economic downturn has created the most fertile fields for insider fraud."

Use The Inside Advantage
Companies should not treat external attacks and internal fraud as two different problems. They need to deal with insiders in the same way they deal with external fraud, Actimize's Knieff says. While insiders have an advantage in terms of knowing the network and corporate policies, companies can also collect a great deal of information that would not be available outside the network.

"Because it is an insider, an institution has a chance to deal with the problem with more information than you would normally have with external fraud," Knieff says.

Background checks, monitoring employee usage of assets, and other intelligence can be used to find hints of whether a worker has turned or could turn rogue.

"An employee might be a star employee for a long time, and he may have some life-changing event away from work -- you have to look for spikes in behavior," he says.

Tap Your Employees
Employees can be a big benefit to companies in detecting malicious behavior by other employees.

In about 40 percent of cases, insider fraud was flagged by a third party, and half of those tips were made by an employee, according to the ACFE report. Customer complaints represented about 18 percent of tips. In many cases, signs of the fraudster's actions are evident. The study found 43 percent of perpetrators are living beyond their means and more than a third of fraudsters have had financial problems.

The statistics should underscore that companies should not rely on any particular technology, says Rich Baich, principal with Deloitte's security and privacy practice. "The real power is in the collaboration and integration of the information created by [security] products, when combined with internal information," he says. "You have to have some technologies in the place. But if you really think there is a technology today [that can solve your problems], the bad guys will find a way around it."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web