Endpoint
11/1/2010
05:26 PM
50%
50%

Tackling Insider Fraud From The Outside-In

Companies should use the same technologies that authenticate external customers to monitor employees and watch for insider attacks

IT managers spend a lot of their time dealing with malicious code and violations of corporate policy, but insider fraud in the workplace is a major problem that frequently shows up on their radar screen, as well.

In 2009, the average company lost nearly 5 percent of its revenue to fraud perpetrated by employees, according to the 2010 Report to the Nations on Occupational Fraud and Abuse (PDF). Asset fraud -- stealing company resources -- represented 90 percent of the incidents, but only averaged $135,000 in losses per company. On the other hand, financial fraud makes up only 5 percent of all cases of corporate fraud, but it is the most damaging, with a median loss of more than $4 million, according to the report, which is published every two years by the Association of Certified Fraud Examiners (ACFE).

Employees can be tempted by their privileged access to data, says Ben Knieff, director of product marketing for fraud products at Actimize. "They have a high level of access, which gives them a greater opportunity to commit fraud," he says.

The report found that 85 percent of fraud was committed by individuals with no prior records of abuse. Even so, there are a number of proactive steps that companies can take.

Limit Access To Critical Data
Data is difficult to tame. Companies that attempt to control the flow of information inside the company could be setting themselves up for failure, says Shane Sims, director at PricewaterhouseCoopers' forensic practice.

"Data has leaked out everywhere. It is not in the central locations like [companies] think it is," he says. "People have exported it; it is on user systems and in data warehouses and on share points. So to me, tackling the insider threats starts with understanding what kind of data you have and where it is."

Even if companies cannot successfully control the movement of data inside their networks, finding out which employees are accessing the most important data can be enough to prevent the most significant potential fraud, he says.

"Continually do background checks for the high-risk people that have access to the crown jewels," Sims says. "The economic downturn has created the most fertile fields for insider fraud."

Use The Inside Advantage
Companies should not treat external attacks and internal fraud as two different problems. They need to deal with insiders in the same way they deal with external fraud, Actimize's Knieff says. While insiders have an advantage in terms of knowing the network and corporate policies, companies can also collect a great deal of information that would not be available outside the network.

"Because it is an insider, an institution has a chance to deal with the problem with more information than you would normally have with external fraud," Knieff says.

Background checks, monitoring employee usage of assets, and other intelligence can be used to find hints of whether a worker has turned or could turn rogue.

"An employee might be a star employee for a long time, and he may have some life-changing event away from work -- you have to look for spikes in behavior," he says.

Tap Your Employees
Employees can be a big benefit to companies in detecting malicious behavior by other employees.

In about 40 percent of cases, insider fraud was flagged by a third party, and half of those tips were made by an employee, according to the ACFE report. Customer complaints represented about 18 percent of tips. In many cases, signs of the fraudster's actions are evident. The study found 43 percent of perpetrators are living beyond their means and more than a third of fraudsters have had financial problems.

The statistics should underscore that companies should not rely on any particular technology, says Rich Baich, principal with Deloitte's security and privacy practice. "The real power is in the collaboration and integration of the information created by [security] products, when combined with internal information," he says. "You have to have some technologies in the place. But if you really think there is a technology today [that can solve your problems], the bad guys will find a way around it."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.