Endpoint
11/1/2010
05:26 PM
Connect Directly
RSS
E-Mail
50%
50%

Tackling Insider Fraud From The Outside-In

Companies should use the same technologies that authenticate external customers to monitor employees and watch for insider attacks

IT managers spend a lot of their time dealing with malicious code and violations of corporate policy, but insider fraud in the workplace is a major problem that frequently shows up on their radar screen, as well.

In 2009, the average company lost nearly 5 percent of its revenue to fraud perpetrated by employees, according to the 2010 Report to the Nations on Occupational Fraud and Abuse (PDF). Asset fraud -- stealing company resources -- represented 90 percent of the incidents, but only averaged $135,000 in losses per company. On the other hand, financial fraud makes up only 5 percent of all cases of corporate fraud, but it is the most damaging, with a median loss of more than $4 million, according to the report, which is published every two years by the Association of Certified Fraud Examiners (ACFE).

Employees can be tempted by their privileged access to data, says Ben Knieff, director of product marketing for fraud products at Actimize. "They have a high level of access, which gives them a greater opportunity to commit fraud," he says.

The report found that 85 percent of fraud was committed by individuals with no prior records of abuse. Even so, there are a number of proactive steps that companies can take.

Limit Access To Critical Data
Data is difficult to tame. Companies that attempt to control the flow of information inside the company could be setting themselves up for failure, says Shane Sims, director at PricewaterhouseCoopers' forensic practice.

"Data has leaked out everywhere. It is not in the central locations like [companies] think it is," he says. "People have exported it; it is on user systems and in data warehouses and on share points. So to me, tackling the insider threats starts with understanding what kind of data you have and where it is."

Even if companies cannot successfully control the movement of data inside their networks, finding out which employees are accessing the most important data can be enough to prevent the most significant potential fraud, he says.

"Continually do background checks for the high-risk people that have access to the crown jewels," Sims says. "The economic downturn has created the most fertile fields for insider fraud."

Use The Inside Advantage
Companies should not treat external attacks and internal fraud as two different problems. They need to deal with insiders in the same way they deal with external fraud, Actimize's Knieff says. While insiders have an advantage in terms of knowing the network and corporate policies, companies can also collect a great deal of information that would not be available outside the network.

"Because it is an insider, an institution has a chance to deal with the problem with more information than you would normally have with external fraud," Knieff says.

Background checks, monitoring employee usage of assets, and other intelligence can be used to find hints of whether a worker has turned or could turn rogue.

"An employee might be a star employee for a long time, and he may have some life-changing event away from work -- you have to look for spikes in behavior," he says.

Tap Your Employees
Employees can be a big benefit to companies in detecting malicious behavior by other employees.

In about 40 percent of cases, insider fraud was flagged by a third party, and half of those tips were made by an employee, according to the ACFE report. Customer complaints represented about 18 percent of tips. In many cases, signs of the fraudster's actions are evident. The study found 43 percent of perpetrators are living beyond their means and more than a third of fraudsters have had financial problems.

The statistics should underscore that companies should not rely on any particular technology, says Rich Baich, principal with Deloitte's security and privacy practice. "The real power is in the collaboration and integration of the information created by [security] products, when combined with internal information," he says. "You have to have some technologies in the place. But if you really think there is a technology today [that can solve your problems], the bad guys will find a way around it."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.