Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Insider Threats

7/19/2018
12:20 PM
Jai Vijayan
Jai Vijayan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

6 Ways to Tell an Insider Has Gone Rogue

Malicious activity by trusted users can be very hard to catch, so look for these red flags.
Previous
1 of 7
Next

Image Source: Mashka via Shutterstock

Image Source: Mashka via Shutterstock

Insiders with legitimate access to enterprise systems and data are responsible for far more data breaches than many might realize. Granted, very often the breaches are accidental or caused by an individual's negligence or failure to follow policy – but when a malicious insider is responsible, the results can be disastrous.

Edward Snowden's 2013 heist of some 1.5 million classified documents from the National Security Agency (NSA), where he worked as a contractor, remains one of the most spectacular examples of insider theft. But there have been countless other incidents in recent years where organizations have experienced serious data loss or damage to systems and data as the result of malicious activity by an insider.

While enterprises are generally cognizant of the threat, many have struggled to deal with it. One reason is that most security tools are not truly designed to spot dangerous or potentially malicious activity by someone with legitimate access to an enterprise system or data. In addition, many organizations have been cautious about implementing too many controls for monitoring insider activity for fear of being viewed as too big brotherly.

"Enterprises are ill-equipped to protect their trusted insiders because legacy systems like employee monitoring or keystroke logging are extremely heavy and invasive to user privacy," says Christy Wyatt, CEO of Dtex Systems. "This means that many organizations have been reluctant to deploy them."

The key to dealing with insider threats is to keep an eye on all those accessing your most sensitive data in a way that does not intrude on privacy. "There are many critical behavior red flags that you can look for in order to accurately and quickly pinpoint insider threats," Wyatt says. "Three of the major red flags we see are data exfiltration, obfuscation, and bypassing security measures."

Here, according to Wyatt and others, are six signs that an insider has gone rogue or is headed that way.

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Larry Larsen
50%
50%
Larry Larsen,
User Rank: Apprentice
7/31/2018 | 1:49:45 PM
Great Reminders
Jai, these are all great reminders on monitoring priviledged users and other trusted insiders.  The biggest issue I've seen on this topic in my career is the lack of willingness to consider such a user as a potential threat.  Users with nefarious intent may count on that to enable their activities.
Mark Coates
50%
50%
Mark Coates,
User Rank: Author
7/25/2018 | 1:04:34 PM
Understanding the Rogue Threat is Key to Security
Excellent education piece on malicious insiders' motivations and behavior patterns. As a member of Christy Wyatt's team at Dtex, we are helping organizations detect behaviors daily that reveal when an insider threat is active. Any business with concerns can use this piece as a guidepost.
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
RDP Bug Takes New Approach to Host Compromise
Kelly Sheridan, Staff Editor, Dark Reading,  7/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-2873
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2874
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2875
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2876
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...
CVE-2019-2877
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...