Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/21/2019
05:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Human Negligence to Blame for the Majority of Insider Threats

In 98% of the assessments conducted for its research, Dtex found employees exposed proprietary company information on the Web - a 20% jump from 2018.

Nearly two-thirds (64%) of insider threats are caused by users who introduce risk due to careless behavior or human error, according to new research from Dtex. This compares to 13% of threats due to compromised credentials and 23% caused by intent on harming the organization.

"That 64% number is huge and something we think companies should focus on," says Rajan Koo, head of Dtex's insider threat research team. "We find that by reducing the number of negligence incidents, companies can cut down on the potential of their employees being compromised."

In related research released this week, Endera reported that companies suffer from at least three workforce-related incidents per week, adding up to 156 incidents per year. And, according to Egress Technologies, more than four out of five companies (83%) have had employees expose customer or business data.

Lock Down Those Links
In 98% of the assessments conducted for its research, Dtex found employees exposed proprietary company information on the Web – a 20% jump from 2018. Typically they send out a document via an insecure link to a colleague or third-party company using file-sharing tools that are unsanctioned by the company, Koo said.

"What happens is people will send a link from their personal Google Docs or Dropbox account, not realizing that the link is not secure," he explains. "In our research, we've found that these documents get indexed on Google and other search engines so the bad guys can easily find them publicly on the Web. We recommend that people lock down any links they send with a user name and password."

The study also found that in 95% of the assessments, employees looked to circumvent company security policies – a notable jump from 60% last year. In many instances, people are using private VPNs and TOR browsers in the hope of shielding their activities, Koo says. While often employees are simply looking to bypass security so they can do their work more efficiently, Dtex has found the use of such tools is often motivated by malicious intent.  

Dtex also runs assessments that track whether a person is a flight risk, which Koo defined as a person with a “propensity to leave.” The company found employees engaging in such behavior in 97% of its assessments. 

"What we'll do is track people who have spent a lot of time updating their LinkedIn profile or posting their resume and then watch to see if they've made a data transfer to a USB," Koo says. "In almost every organization, people tagged with a high propensity to leave typically take data with them. For each organization we've studied, we find at least one example of this a year."

Koo says security pros have become really good at protecting the perimeter from malware attacks. But as the perimeter erodes with more people working from home, the introduction of cloud-based apps, and the entrance of a younger, digitally fearless workforce who may log onto a corporate network from an insecure outside network, a new crop of user behavior intelligence platforms has surfaced.

These platforms enable companies such as Dtex, Endera, and others to leverage user behavior analytics to more efficiently detect insider threats.

Avivah Litan, a vice president and distinguished analyst at Gartner, says this emerging field of user behavior analytics has been a missing piece in corporate security profiles – until now.

"Dtex and other companies, along with the traditional SIEM vendors, have solutions … that sit on the user's device and can see things that you can't see from the cloud," Litan says. "Companies need to take a look at monitoring users, but do it in a way that respects privacy."

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/22/2019 | 9:38:29 AM
No shit Sherlock?
This should come as a surprise to nobody.  'Gee, that email looked real enough?"   And that invoice looked nice.  Maybe I did get a refund.  Users are always the weak link.  The weight of infections delivered through phishing attacks is immense and yet, people still click and click.   This is no surprise at all. 
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9678
PUBLISHED: 2019-09-18
Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for v...
CVE-2019-9679
PUBLISHED: 2019-09-18
Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time i...
CVE-2019-9680
PUBLISHED: 2019-09-18
Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by constructing malicious data packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-...
CVE-2019-9677
PUBLISHED: 2019-09-18
The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X fo...
CVE-2019-14458
PUBLISHED: 2019-09-18
VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.