SMB Insider Threat: Don't Hire A Hacker

Part 1 in a series

Last month, Edward Snowden reminded us that the greatest threat to our critical systems and sensitive data is not the external hacker, but the trusted insider. While leaks pertaining to large government agencies capture the headlines, the SMB insider silently threatens our organizations with devastating impact.

Employees and contractors with trusted access to SMB systems and data are considered insiders and are typically afforded a high level of trust. Although we like to trust that our employees have our best interest in mind, we need to recognize that they pose a significant threat, and we should protect our businesses from the potential damage they may cause. In others words, trust but verify.

Of course, the insider threat is nothing new, and a great many process and controls have been developed to reduce the risk. Many of these controls rely on a complex organizational structures, audit departments, and other elaborate processes that don't always play well in the SMB space. This three-part blog will discuss a measured approach to addressing the insider threat based on the needs of the SMB.

Part 1: Employment Screening
The single best way to address the insider threat is to limit the hiring of a threat in the first place. While certainly not a foolproof method, pre-employment screening is the best control available. Employment screening consists of various verification checks (e.g., criminal history, employment verification, supervisor and salary checks, and education verification).

There are a lot of untrustworthy people out there looking for jobs. Employment screening helps to sort them out. Industry estimates range from 30 to 35 percent of employment applications contain a lie about employment dates, positions held, salaries earned, and even degrees obtained. Lying on an application about these fundamental attributes of work history is a clear indicator or someone who is not trustworthy.

SMBs have two unique characteristics that make employment screening a must. First, SMBs attract a larger share of untrustworthy applicants. Larger corporations have adopted the pre-employment screening process; some 80 to 85 percent of large corporations utilize employment screening. This fact is well-known and affects the behavior of those candidates who are bound to be flagged by such a process -- they flock to SMBs that are less likely to perform these screenings.

While I was at a hacker conference several years ago, I overheard the following conversation:

Hacker 1: "I heard you got a steady job at XXX corporation. How'd you pass the employment checks?"

Hacker 2: "Oh, they don't do them there. I've let a couple of guys know about it already -- you should apply."

By not performing employment screening, not only are you not screening out potentially untrustworthy candidates, but as word gets around, you are actually attracting them.

The second unique characteristic of SMBs that makes employment screening a must is the reduced organizational structure of the SMB. In larger corporations, controls such as least privilege and separation of duty can be more easily applied based on the number of positions and organizational departments. In an SMB, many of these roles are consolidated into a single position. In places where these positions have been collapsed, careful consideration must be given to the placement of an individual -- this is a very trust-needy position.

In the next blog I will address policy controls to address the SMB insider threat.

Doug Landoll CEO of Assero Security