Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/21/2019
05:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Human Negligence to Blame for the Majority of Insider Threats

In 98% of the assessments conducted for its research, Dtex found employees exposed proprietary company information on the Web - a 20% jump from 2018.

Nearly two-thirds (64%) of insider threats are caused by users who introduce risk due to careless behavior or human error, according to new research from Dtex. This compares to 13% of threats due to compromised credentials and 23% caused by intent on harming the organization.

"That 64% number is huge and something we think companies should focus on," says Rajan Koo, head of Dtex's insider threat research team. "We find that by reducing the number of negligence incidents, companies can cut down on the potential of their employees being compromised."

In related research released this week, Endera reported that companies suffer from at least three workforce-related incidents per week, adding up to 156 incidents per year. And, according to Egress Technologies, more than four out of five companies (83%) have had employees expose customer or business data.

Lock Down Those Links
In 98% of the assessments conducted for its research, Dtex found employees exposed proprietary company information on the Web – a 20% jump from 2018. Typically they send out a document via an insecure link to a colleague or third-party company using file-sharing tools that are unsanctioned by the company, Koo said.

"What happens is people will send a link from their personal Google Docs or Dropbox account, not realizing that the link is not secure," he explains. "In our research, we've found that these documents get indexed on Google and other search engines so the bad guys can easily find them publicly on the Web. We recommend that people lock down any links they send with a user name and password."

The study also found that in 95% of the assessments, employees looked to circumvent company security policies – a notable jump from 60% last year. In many instances, people are using private VPNs and TOR browsers in the hope of shielding their activities, Koo says. While often employees are simply looking to bypass security so they can do their work more efficiently, Dtex has found the use of such tools is often motivated by malicious intent.  

Dtex also runs assessments that track whether a person is a flight risk, which Koo defined as a person with a “propensity to leave.” The company found employees engaging in such behavior in 97% of its assessments. 

"What we'll do is track people who have spent a lot of time updating their LinkedIn profile or posting their resume and then watch to see if they've made a data transfer to a USB," Koo says. "In almost every organization, people tagged with a high propensity to leave typically take data with them. For each organization we've studied, we find at least one example of this a year."

Koo says security pros have become really good at protecting the perimeter from malware attacks. But as the perimeter erodes with more people working from home, the introduction of cloud-based apps, and the entrance of a younger, digitally fearless workforce who may log onto a corporate network from an insecure outside network, a new crop of user behavior intelligence platforms has surfaced.

These platforms enable companies such as Dtex, Endera, and others to leverage user behavior analytics to more efficiently detect insider threats.

Avivah Litan, a vice president and distinguished analyst at Gartner, says this emerging field of user behavior analytics has been a missing piece in corporate security profiles – until now.

"Dtex and other companies, along with the traditional SIEM vendors, have solutions … that sit on the user's device and can see things that you can't see from the cloud," Litan says. "Companies need to take a look at monitoring users, but do it in a way that respects privacy."

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/22/2019 | 9:38:29 AM
No shit Sherlock?
This should come as a surprise to nobody.  'Gee, that email looked real enough?"   And that invoice looked nice.  Maybe I did get a refund.  Users are always the weak link.  The weight of infections delivered through phishing attacks is immense and yet, people still click and click.   This is no surprise at all. 
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17789
PUBLISHED: 2019-09-20
Prospecta Master Data Online (MDO) allows CSRF.
CVE-2019-11280
PUBLISHED: 2019-09-20
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain ...
CVE-2019-11326
PUBLISHED: 2019-09-20
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same pro...
CVE-2019-11327
PUBLISHED: 2019-09-20
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system.
CVE-2019-14814
PUBLISHED: 2019-09-20
There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.