Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/29/2012
06:24 PM
50%
50%

Top 5 Myths About Insider Threats

Myths about who insiders are and how they're putting data at risk keep mitigation efforts at bay

Misconceptions and misunderstandings abound when it comes to insider threats. Many organizations fail to identify the scope and severity of risk posed by insiders because they adhere to mistaken beliefs about what kind of insiders present danger to their organizations and how. Similarly, misapprehension about security controls further adds to misapplied mitigation efforts.

If organizations are to work on reducing insider risks, then they first need to bust the myths around them that could be holding back their progress.

1. Myth: The majority of internal data breaches are intentional
This is one of the most common insider myths out there, says Alan Brill, senior managing director of Kroll Advisory Solutions.

"At any given moment, there's a portion of population that's up to no good, but it's a small percentage," Brill says. "Generally, people want to do the right thing."

The only problem is that if an organization doesn't tell these otherwise good people what the wrong thing is, they may not know it, he says. Often employees put business data at risk for convenience sake -- for example, to load a thumb drive with sensitive customer files or valuable schematics into a public cloud storage service like Dropbox so they can work from home.

"The majority of cases you ultimately see are traced back not to a deliberate desire to hurt the company or do something illegal or immoral, but for some kind of purpose with good intentions," Brill says. "But they always say that the road to hell is paved in good intentions."

[ Making the case against an insider takes preparation and proactive work with HR and legal. See 5 Ways To Lose A Malicious Insider Lawsuit. ]

2. Myth: Insider threats are limited to the organization’s employees
Employees are not the only insiders organizations need to worry about, Brill warns.

"You look at organizations and see that they don't just have employees, but they also have temps and they have contractors and they have vendors and those vendors have vendors," he says, "and they enter into various cloud arrangements [to share data] and the real question is ultimately who has access to data?"

He warns that if you can't answer that question effectively, then you have a big problem. For example, he has seen many clients with breach issues that had no policies set to centralize notification when any representative of the company entered into an outsourcing or cloud arrangement -- meaning there was no way to even know when data was moving outside the organization. This is a situation every business should avoid, he says.

"It is important to get a handle on where the sensitive data is and whether you're still responsible for it if someone else has it, and, if so, how they're protecting it and whether they're indemnifying you in any way if they screw it up," he says.

3. Myth: Securing against insider attacks in a virtualized cloud environment is the same as for a physical environment
Virtualization may have made things immeasurably easier for IT to maintain its infrastructure, but it also makes it easy for insiders to pilfer information, says Eric Chiu, president and founder of HyTrust. The centralized, compact nature of VMs provide a perfect "to-go" package for malicious insiders to easily steal a greater concentration of information.

"Insider attacks within a virtualized environment are much easier than a physical environment since access to the virtual infrastructure gives you access to all of the VMs and virtualized resources," he says. "An admin can easily copy a VM onto a USB drive or laptop, for example."

As organizations think about preventing attacks such as those that plagued Shionogi Pharmaceuticals and Gucci last year, Chiu suggest they think carefully about how they institute controls such as separation of duties, which pose a bigger challenge within virtual infrastructure than traditional physical infrastructure.

"Virtualization admins have the ultimate keys to the kingdom to steal data, misconfigure systems, and wreak havoc within the data center," he says.

4. Myth: Data can be protected by wrapping access control around it and firewalling it
Whether the insiders themselves are the ones stealing data or the bad guys are manipulating clueless insiders to carry out attacks, the fact is that a few simple access controls and firewalls aren't sufficient to protect data today.

"Vulnerabilities, exploits, and social-engineering attacks get malware in, sophisticated malware gets data out over diverse channels -- FTP, email, files, encrypted payloads, steganography," says Mark Bower, vice president of product management at Voltage Security. "It’s as simple as that. It takes just one chink in the armor to open up a Pandora's box of sensitive content for a well-organized team of reconnaissance, payload drop, and command-and-control experts -- probably offshore and at arm’s length of the law."

He argues that the only way to really protect the data is by taking a data-centric approach that relies on protections such as encryption to make data useless to attackers.

"Data-centric protection as prevention, engineered into applications and IT policy, needs to be the No. 1 item on CISOs’ shopping lists," Bower says. "The question that should be being asked is not how to prevent a breach, but how to contain the fallout when it happens."

5. Myth: Monitoring employees always reduces risks
Monitoring is hardly a panacea for reducing insider risks for organizations. While many organizations today have instituted some form of employee monitoring, when this technology is improperly applied it may as well not even exist.

"We go in very often after something terrible happens and say we need to look at the log files to see what happened. And sometimes we have clients who say, 'We have logs,'" Brill says. "We say, 'Great, how far back do they go?' and they say '48 hours.' The problem is the incident occurred two weeks ago."

Chiu agrees that this is a common type of scenario, noting that organizations are also stymied from the use of difficult-to-track root accounts and a lack of centralized SIEM tools to alert them when bad things are happening.

"Most companies have inadequate logging to detect insider breaches within their environments," he says.

And even if the controls are correctly implemented to track behavior, they may also be introducing undue legal risks to the party.

"The growth in monitoring employee behavior in digital environments is increasingly enabled by new technology and services," said Andrew Walls, research vice president of Gartner. "Surveillance of individuals, however, can both mitigate and create risk, which must be managed carefully to comply with ethical and legal standards."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17364
PUBLISHED: 2020-08-05
USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.
CVE-2020-4481
PUBLISHED: 2020-08-05
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181848.
CVE-2020-5608
PUBLISHED: 2020-08-05
CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered c...
CVE-2020-5609
PUBLISHED: 2020-08-05
Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to cre...
CVE-2020-8607
PUBLISHED: 2020-08-05
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentia...