Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

// // //
08:05 AM
Steve Durbin
Steve Durbin
News Analysis-Security Now
Connect Directly
E-Mail vvv

Cybercriminals Increasingly Targeting 'Crown Jewels' Both Inside & Out

Protecting the 'crown jewels' of an enterprise and organization is always a top priority. However, cybercriminals are now trying to steal this privileged data from both inside, as well as outside, businesses of all kinds.

For centuries, organizations have been acquiring, producing, leasing, licensing and selling assets. Accounted for in financial statements, these assets represent an organization's wealth and financial stability.

This also makes them vulnerable to theft and fraud.

As a priority, organizations should focus on those assets that are of the highest value and risk -- commonly referred to by business leaders as the "crown jewels."

Assets such as property, plant and equipment are tangible whereas information is an intangible asset. There are two types of intangible assets:

  • Legal -- such as trade secrets, copyrights and customer lists
  • Competitive -- such as company culture, collaboration activities and customer relationships

Both types are essential drivers of competitive advantage and shareholder value today. It's common to view the value or importance of information by using a simple classification chart.

(Source: Flickr)
(Source: Flickr)

However, mission-critical information assets represent only the very tip of the highest layer. Information of high business value or impact could still register as "high" or "critical" but not necessarily be designated as mission-critical.

Traditional risk assessment approaches would not identify this information separately, so mission-critical information assets typically require a different approach to identification.

Information Security Forum (ISF) research has uncovered two main factors that typically influence whether or not an information asset is classed as a crown jewel. The first is its value to the organization. The second is its potential impact if the asset is compromised.

At the ISF, we refer to information assets with a high value and business impact rating as "mission-critical information assets." Examples of mission-critical information assets include details of:

  • information that supports overall business operations, including board papers, M&A or upcoming redundancy plans
  • material relating to possible and planned future products and services, such as formulas for new drugs, engineering specifications or upcoming exploration locations
  • information relating to promoting and selling an organization's products and services that can include non-competition agreements, competitive analysis or an upcoming marketing campaign

When identifying mission-critical information assets, organizations should consider whether:

  • the information asset contributes to, or supports, business value, which include business revenue, competitive advantage, operational effectiveness, as well as legal, regulatory or contractual compliance
  • the business could be impacted in the event of the confidentiality, integrity or availability of the information asset being compromised, considering any financial, operational, legal/ regulatory compliance, reputational, or health and safety implications

Insiders pressured into giving up crown jewels
Privileged insiders, or individuals with access to an organization's crown jewels, are some of the most dangerous people within an organization. They are often a diverse and unconnected group within the organization, extending beyond senior business managers, and by proxy, their personal assistants.

Those with access to the crown jewels can also include people in the roles of systems administrator, infrastructure architect and network support engineer, as well as specific external contractors.

In the coming years, new attacks will impact both business reputation and shareholder value, and cyber risk exists in every aspect of the enterprise. Even in the cybercrime era, the age-old threat of violence still spreads fear. To achieve greater gains, well-funded criminal groups will combine their substantial global reach and digital expertise with intimidation or savagery to threaten privileged insiders into giving up mission-critical information assets such as financial details, intellectual property (IP) and strategic plans.

An organization that loses any of their crown jewels to attackers will be impacted by heavy financial losses and brand damage when planned products are copied and released earlier by competitors. Targeted organizations that cannot guarantee the safety of their highly skilled privileged insiders may find recruitment and retention increasingly difficult.

Cybercriminals' inspiration
The growing value of information, combined with the ability of organized criminal groups to profit from its theft, has led to a dramatic rise in cybercrime rates. (See Cybercrime: More Like Facebook's Model Than Traditional Criminal Enterprise.)

An approach frequently employed by cybercriminals to steal information is to exploit privileged credentials. In the past, by recruiting even more people with the skills to steal credentials, organized criminal groups have realized a marked improvement in profits from cybercrime.

Nevertheless, there is another way to gain access to such credentials: directly from the people themselves, each of whom becomes a physical target.

The tactic of targeting specific individuals has already been successful in other lucrative areas of criminal activity.

Individuals to target can be identified through sources such as LinkedIn or Facebook. Coercion can then take place in either a virtual or physical environment. For example, a technique of "sextortion" can be adapted to blackmail insiders into handing over an organization's crown jewels.

In extreme cases, criminals may also resort to violence, or the threat of violence against a privileged insider, including holding the family captive until the crown jewels have been compromised, a tactic which has been used successfully during armed robberies.

Criminal gangs will see merit in coercing privileged insiders into providing direct access to an organization's systems as they will be able to:

  • significantly reduce the level of cyber expertise they require: replacing that expertise with "muscle"
  • continue to enjoy access to one or more individuals who have already "assisted" the gangs and can easily be persuaded to do so again
  • simplify the process of stealing mission-critical information assets by operating at "arm's length"

Moving forward, merciless criminal groups, rogue competitors and nation-states will directly target mission-critical information assets. If compromised, the loss of this data can cripple an organization.

Consequently, an organization should take steps to identify and record these assets. The individuals with access to, or responsibility for, the management and protection of these assets should also be identified on that record.

At the same time, procedures can be put in place for individuals to report any coercion or threat, and arrangements made for anyone affected to receive appropriate protection.

Be prepared
As dangers accelerate, organizations must fully commit to disciplined and practical approaches to managing the major changes ahead. Employees at every level of the organization will need to be involved, including board members and managers in non-technical roles.

Here are a few recommendations to consider:

  • Identify the organization's mission-critical information assets, and the individuals who own and access them
  • Invest in special measures to protect individuals with privileged access, including instruction in physical security precautions, as well as exposure to social engineering methods
  • Implement mechanisms to protect the organization against the insider threat, which includes screening prospective employees and embedding appropriate clauses in employment contracts
  • Adopt a "trust-but-verify" approach to privileged insiders

Related posts:

Steve Durbin is managing director of the Information Security Forum. His main areas of focus include strategy, information technology, cybersecurity and the emerging security threat landscape across both the corporate and personal environments. He is a frequent speaker and commentator on technology and security issues. Previously, he was a senior vice president at Gartner.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file