Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

10/30/2019
02:55 PM
50%
50%

Security Pros Fear Insider Attacks Stem from Cloud Apps

More than half of security practitioners surveyed say insider attack detection has grown more difficult since migrating to cloud.

Security professionals consider cloud applications more vulnerable to insider attacks and say insider threats are more difficult to detect since migrating to the cloud, new survey data shows.

In a survey of more than 300 security pros conducted by Cybersecurity Insiders and sponsored by Securonix, 70% report insider attacks have become more frequent in the past year and 21% have experienced more than five insider attacks in the same time frame. More than half (56%) say monitoring, detecting, and responding to insider threats is "somewhat effective" or worse.

Many seem to think cloud applications are to blame: Thirty-nine percent identified cloud storage and file-sharing apps as the most vulnerable to insider attacks, and 56% believe detecting insider attacks has grown "significantly" or "somewhat" harder since they migrated to the cloud. Despite the perceived risk, only 40% monitor user behavior across their cloud environments.

Nearly 70% of respondents said they feel "moderately" to "extremely" vulnerable to insider threats, the top motivations for which are fraud, financial gain, IP theft, corporate sabotage, and espionage. When asked about individuals who pose the greatest risk for insider attacks, 59% pointed to privileged IT users or admins, followed by contractors/service providers/temp workers (52%).

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Is Voting by Mobile App a Better Security Option or Just 'A Bad Idea'?."

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15570
PUBLISHED: 2020-07-06
The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file.
CVE-2020-15569
PUBLISHED: 2020-07-06
PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
CVE-2020-7690
PUBLISHED: 2020-07-06
It's possible to inject JavaScript code via the html method.
CVE-2020-7691
PUBLISHED: 2020-07-06
It's possible to use <<script>script> in order to go over the filtering regex.
CVE-2020-15562
PUBLISHED: 2020-07-06
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.