Insider Threats Get More Difficult To Detect

Iris Scans: Security Technology In Action

While Edward Snowden's name will forever be linked to his leak of classified National Security Agency data, it might come to stand for something else: The moment in time when insider threats became as important a security issue to government and other enterprises as advanced persistent threats.

A new survey of more than 700 Fortune 1000 IT pros indicates that the job of protecting against insider threats from employees, contractors or partners -- or those posing as authorized users -- is growing more difficult.

The survey findings, released this week by Enterprise Strategy Group, state that more than half (54%) of enterprise IT pros are finding insider threats more difficult to detect or prevent than they were in 2011. One reason is the increasing sophistication of malicious software that lets users gain legitimate internal access privileges to networks, applications and sensitive data.

[ The head of the National Security Agency defends the agency's actions. Read NSA Chief: Don't Dump Essential Security Tools. ]

"The barriers to network breaches are really melting away," said Alan Kessler, CEO of security vendor Vormetric, which sponsored the research. The firewalls that once kept potential intruders at bay "are essentially gone, because the adversaries are working from inside," he said in an interview with InformationWeek.

But there are other factors. Among survey respondents, 17% of whom work for government agencies or in education:

-- 37% point to the fact that there are more people -- employees, contractors and business partners -- with access to the network, making it more difficult to isolate suspicious behavior.

-- 36% say that the growing use of cloud computing at their organizations makes insider threat detection/prevention more difficult, as it increases the attack surface for insiders.

-- 35% say the growing volume of network activity also makes detection and prevention of insider attacks more difficult, as it makes it harder to baseline normal behavior and pinpoint anomalies. -- 27% say advanced persistent threats complicate detection and prevention of insider threats. There's the sense that insiders are also using sophisticated attack techniques that emulate "normal" behavior.

As a consequence, nearly half (46%) of the IT pros surveyed say they think their organization is vulnerable to a variety of insider attack methods, including: abuse of privileged employee access rights, theft of devices containing sensitive data, and abuse of access rights by non-privileged employees or contractors.

The risk that system administrators and other employees might abuse their access privileges, however, has gained wider senior management attention. Nearly half (45%) of those surveyed say that the Snowden affair has changed their organization's perspective on insider threats either substantially or somewhat.

The biggest threat, say 51% of survey respondents, is likely to come from non-technical employees with legitimate access to sensitive data and IT assets, followed by third-party contractors (48%); IT administrators (34%); business partners, customers or suppliers (24%); IT service providers (24%); or other IT employees or executives.

What can enterprises do? One tip comes from the NSA's director, Gen. Keith Alexander. After the Snowden leak, the NSA instituted "a two-person rule," requiring two authorized individuals to be present whenever specific kinds of information are to be transferred onto removable media. Enterprises also need to assess what data is most important, where it's located and how it's protected, said Sol Cates, Vormetric's chief security officer. "You can slice and dice who has privileges, but not enough goes into what they can do with those privileges" or the data they're handling, he said.

To further reduce the risk of insider threats, enterprises need to:

-- Limit the data IT administrators can access to only the data they need to do their jobs.

-- Use data encryption technology.

-- Continually monitor access to sensitive data for signs of abuse.

-- Implement automated alerts when suspicious/malicious behavior is suspected.

The challenge, Cates concedes, is that as the volume of data and activity continues to grow, it's not easy to distinguish malicious behavior from the norm. The goal, he says, is to remove people from the equation and automate data access so that the infrastructure is essentially "blind" to the data.