Vulnerabilities / Threats

5/31/2017
02:00 PM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

The Case for Disclosing Insider Breaches

Too often organizations try to sweep intentional, accidental or negligent employee theft of data under the rug. Here's why they shouldn't.

Stolen credentials are often the entry point attackers use to access sensitive data, and often the first thing to come to mind is a cyber activist with an ax to grind, or a state-sponsored crime ring bent on financial gain or IP theft. But executives would do well to recognize that their own employees can play a significant role in compromising their organizations’ cybersecurity. Insider threats – accidental and inadvertent, or deliberate and malicious – are becoming increasingly common as technology rapidly evolves and employee education struggles to keep pace.

We rarely see accurate data regarding the scope of the problem when it comes to accidental or negligent employee insider threats. And unfortunately, organizations often try to sweep these breaches under the rug. As a CISO, I can sympathize with many organizations’ hesitation to include full breach details. Here’s why:

  • It will tarnish their brand. Companies want their customers to trust them especially as they are the keepers of more customer data than ever before. A breach can seriously erode that perception, and get customers thinking twice before they buy next time.  
  • It’s expensive, and embarrassing! Regardless of the fact, many companies feel a breach reflects a failure on their part, and revealing the details may open them up to further questions about their practices and policies. Plus, cleaning up after a breach can also be very costly.    
  • They aren’t required to disclose the breach. Right now, there are a patchwork of breach notification laws that can vary by state, industry and breach type. However, with emerging regulations such as the GDPR, we can expect to see a change.

These are all valid concerns. And although on the surface the consequences seem to greatly outweigh the benefits, hear me out…

I think organizations should seek to help one another by fully (or at least to the furthest extent possible) disclosing insider breaches whether they are malicious or inadvertent. This would help organizations better understand their adversaries and demonstrate where they need to focus cybersecurity training and education efforts.

Not convinced?

During the summer and fall 2016, a DuPont employee copied and removed thousands of files containing DuPont’s proprietary information including formulas, data, and customer information. Shortly after, the employee announced his retirement while simultaneously opening his own consulting business. Prior to his exit, another DuPont employee caught him taking photos of DuPont’s equipment with his personal phone. Without going into too much detail, the incident was reported up the management chain and naturally escalated from there. DuPont brought the alleged theft to the FBI and disclosed all the information they had up to this point.

The employee was at DuPont for 27 years. This, no doubt, could have seriously damaged DuPont’s reputation if they had not taken the appropriate approach. DuPont had the ability to quickly and quietly sweep this under the rug. Instead, the company gathered as much information as they could, reported the insider to the authorities, and demonstrated how it is very possible for other organizations do the same.

I applaud DuPont’s approach and will use this example to break down the advantages of disclosing insider breaches:

  • You get in front of the story (and the backlash). Suppose DuPont decided to keep this information to themselves. There is a good chance that eventually someone, somewhere would have figured it out. Instead, they were direct and upfront about the incident.
  • It enables companies to band together. We learn from each other’s mistakes! I have no doubt that organizations caught wind of DuPont’s approach and trained their employees on spotting insider threats. If it had been due to negligence or an inadvertent mistake, this would have also been a teachable moment.
  • There’s data for developing mitigation strategies. This can help inform an organization, or even best practices within an entire industry. Data can help reveal where the threats are and the scope and size of the problem.

So, the real question is, will organizations’ mentality ever change? When will they begin to realize the benefits of disclosing breaches to help one another out and work toward the greater good?

In highly regulated industries, we are beginning to see change. As regulations around data become more prevalent (as we are seeing in the EU and beyond), publicly-traded companies will be required to explain how breaches occurred within a fully developed breach report. It’s the smaller and self-contained industries and businesses that we will continue to rarely hear about; they tend to keep the classified information that they contain and clean up in-house.

Insider threats are some of the most serious threats a company can face. By disclosing and sharing the comprehensive data we collect on real-world incidents, we can better educate employees, reduce the success of malicious actors and build more secure environments and stronger overall organizations. 

Check out the all-star panels at the 'Understanding Cyber Attackers & Cyber Threats' event June 21 and get an in-depth look at your cyber adversaries. Click here to register. 

Related Content:

With 15-plus years of leadership experience implementing vendor security risk and assessment programs for startups and Fortune 500 companies, Jackson defines the security road map for SecureAuth's suite of adaptive authentication and IS solutions. Prior to joining SecureAuth, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.