Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Insider Threats

7/19/2018
12:20 PM
Jai Vijayan
Jai Vijayan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

6 Ways to Tell an Insider Has Gone Rogue

Malicious activity by trusted users can be very hard to catch, so look for these red flags.
Previous
1 of 7
Next

Image Source: Mashka via Shutterstock

Image Source: Mashka via Shutterstock

Insiders with legitimate access to enterprise systems and data are responsible for far more data breaches than many might realize. Granted, very often the breaches are accidental or caused by an individual's negligence or failure to follow policy – but when a malicious insider is responsible, the results can be disastrous.

Edward Snowden's 2013 heist of some 1.5 million classified documents from the National Security Agency (NSA), where he worked as a contractor, remains one of the most spectacular examples of insider theft. But there have been countless other incidents in recent years where organizations have experienced serious data loss or damage to systems and data as the result of malicious activity by an insider.

While enterprises are generally cognizant of the threat, many have struggled to deal with it. One reason is that most security tools are not truly designed to spot dangerous or potentially malicious activity by someone with legitimate access to an enterprise system or data. In addition, many organizations have been cautious about implementing too many controls for monitoring insider activity for fear of being viewed as too big brotherly.

"Enterprises are ill-equipped to protect their trusted insiders because legacy systems like employee monitoring or keystroke logging are extremely heavy and invasive to user privacy," says Christy Wyatt, CEO of Dtex Systems. "This means that many organizations have been reluctant to deploy them."

The key to dealing with insider threats is to keep an eye on all those accessing your most sensitive data in a way that does not intrude on privacy. "There are many critical behavior red flags that you can look for in order to accurately and quickly pinpoint insider threats," Wyatt says. "Three of the major red flags we see are data exfiltration, obfuscation, and bypassing security measures."

Here, according to Wyatt and others, are six signs that an insider has gone rogue or is headed that way.

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Larry Larsen
50%
50%
Larry Larsen,
User Rank: Apprentice
7/31/2018 | 1:49:45 PM
Great Reminders
Jai, these are all great reminders on monitoring priviledged users and other trusted insiders.  The biggest issue I've seen on this topic in my career is the lack of willingness to consider such a user as a potential threat.  Users with nefarious intent may count on that to enable their activities.
Mark Coates
50%
50%
Mark Coates,
User Rank: Author
7/25/2018 | 1:04:34 PM
Understanding the Rogue Threat is Key to Security
Excellent education piece on malicious insiders' motivations and behavior patterns. As a member of Christy Wyatt's team at Dtex, we are helping organizations detect behaviors daily that reveal when an insider threat is active. Any business with concerns can use this piece as a guidepost.
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Who knew face masks could also prevent the PII from spreading
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31618
PUBLISHED: 2021-06-15
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why...
CVE-2021-20027
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
CVE-2021-32684
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
CVE-2021-34693
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
CVE-2021-27887
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...