Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

02:00 PM
Hitesh Sheth
Hitesh Sheth
Connect Directly
E-Mail vvv

Dealing With Insider Threats in the Age of COVID

Dangerous gray areas like new BYOD policies and shadow IT devices have increased, thanks to the rapid shift to remote working.

Although the toll of an insider attack in North America can cost a company more than $11 million a year, many still consider insider threats to be too rare to constitute a real threat. Attacks resulting from insider threats are widely regarded as extreme outliers and consequently taken less seriously by leadership and security teams.

Nonetheless, companies should be mindful of dangerous gray areas, especially when considering attackers are always looking for the path of least resistance. These gray areas may include new bring-your-own-device policies and shadow IT devices that result from the rapid shift to remote work or high employee turnover rates.

Related Content:

Time for Insider-Threat Programs to Grow Up

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

New on The Edge: CFAA 101: A Computer Fraud & Abuse Act Primer for InfoSec Pros

The average impact of insider threats does not say anything about the overall frequency. Even if the average per-breach loss to a company is minor, cumulative losses can intensify if insider threats occur frequently. And this doesn't include reputation loss, which is tough to measure and harder to overcome.

The threat landscape has broadened and diversified, especially since the COVID-19 outbreak in March 2020. The global workforce is now largely remote and can work from just about anywhere — not just at home. A lack of security awareness of exploits — such as email phishing attacks and voice phishing attacks that target employee VPN credentials — can be costly.

Reduced and changing worker loyalties to employers and higher employee churn rates also expand the gray area. Examples include unintentional misbehavior and misuse of resources, neglected security vulnerabilities, violations of company policies, and theft. The 2018 trade secret dispute between Waymo and Uber underscores the huge risks employers face in safeguarding intellectual property (IP) when employees leave.

Not all gray-area cases result in catastrophic losses, but they can quickly become very costly in aggregate. A growing number of smaller cases occur below the radar with rarely a mention from victimized companies. The danger is that negligent and malicious practices in the gray area become widely accepted without acknowledgment and action.

Besides a strict reinforcement of nondisclosure agreements that protect company IP, employees must understand that preserving confidential information from a previous employer is unlawful. Employee awareness and training are important factors in changing employee attitudes about ethical standards in the workplace, and employers must be prepared to practice what they preach.

I recommend that company leadership dedicate resources to consistently uphold these ethical principles, even if it means denying new employees from sharing information from their prior employers that could benefit you in the short-term.

Another area for improvement involves deploying network monitoring tools to track vital company IP and other critical assets across cloud, data center, Internet of Things, and enterprise networks. Do you know where your organization's most important assets reside? If a malicious insider were to gain access via lateral movement or another means, do you have data protection policies deployed?

The ever-expanding gray area of insider threats forces businesses to think beyond simple monitoring for forensics and litigation purposes. Instead, anticipate the actual threat itself by proactively detecting and responding to malicious behaviors that can lead to a data breach or theft.

The truth is the red flags that often denote an insider threat are hard to delineate from false positives or other risks. Unfortunately, the key to pulling off an effective attack as a malicious insider is in the details. You must blend in with normal behaviors, use the access you have, and be mindful not to overstep authorization to avoid detection before your plan can unfold.

Suppose you are looking to reduce the likelihood of these insider jobs. In that case, you must first understand that while these are often not premeditated, your security team and other personnel must be prepared to spot anomalies in their everyday workflows.

Hitesh Sheth is the president and CEO of Vectra. Previously, he held the position of chief operating officer at Aruba Networks. Hitesh joined Aruba from Juniper Networks, where he was EVP/GM for its switching business and before that, SVP for the Service Layer Technologies ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-13
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying th...
PUBLISHED: 2021-05-13
An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.
PUBLISHED: 2021-05-13
An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.
PUBLISHED: 2021-05-13
An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another serv...
PUBLISHED: 2021-05-13
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.