Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/29/2012
06:24 PM
50%
50%

Top 5 Myths About Insider Threats

Myths about who insiders are and how they're putting data at risk keep mitigation efforts at bay

Misconceptions and misunderstandings abound when it comes to insider threats. Many organizations fail to identify the scope and severity of risk posed by insiders because they adhere to mistaken beliefs about what kind of insiders present danger to their organizations and how. Similarly, misapprehension about security controls further adds to misapplied mitigation efforts.

If organizations are to work on reducing insider risks, then they first need to bust the myths around them that could be holding back their progress.

1. Myth: The majority of internal data breaches are intentional
This is one of the most common insider myths out there, says Alan Brill, senior managing director of Kroll Advisory Solutions.

"At any given moment, there's a portion of population that's up to no good, but it's a small percentage," Brill says. "Generally, people want to do the right thing."

The only problem is that if an organization doesn't tell these otherwise good people what the wrong thing is, they may not know it, he says. Often employees put business data at risk for convenience sake -- for example, to load a thumb drive with sensitive customer files or valuable schematics into a public cloud storage service like Dropbox so they can work from home.

"The majority of cases you ultimately see are traced back not to a deliberate desire to hurt the company or do something illegal or immoral, but for some kind of purpose with good intentions," Brill says. "But they always say that the road to hell is paved in good intentions."

[ Making the case against an insider takes preparation and proactive work with HR and legal. See 5 Ways To Lose A Malicious Insider Lawsuit. ]

2. Myth: Insider threats are limited to the organization’s employees
Employees are not the only insiders organizations need to worry about, Brill warns.

"You look at organizations and see that they don't just have employees, but they also have temps and they have contractors and they have vendors and those vendors have vendors," he says, "and they enter into various cloud arrangements [to share data] and the real question is ultimately who has access to data?"

He warns that if you can't answer that question effectively, then you have a big problem. For example, he has seen many clients with breach issues that had no policies set to centralize notification when any representative of the company entered into an outsourcing or cloud arrangement -- meaning there was no way to even know when data was moving outside the organization. This is a situation every business should avoid, he says.

"It is important to get a handle on where the sensitive data is and whether you're still responsible for it if someone else has it, and, if so, how they're protecting it and whether they're indemnifying you in any way if they screw it up," he says.

3. Myth: Securing against insider attacks in a virtualized cloud environment is the same as for a physical environment
Virtualization may have made things immeasurably easier for IT to maintain its infrastructure, but it also makes it easy for insiders to pilfer information, says Eric Chiu, president and founder of HyTrust. The centralized, compact nature of VMs provide a perfect "to-go" package for malicious insiders to easily steal a greater concentration of information.

"Insider attacks within a virtualized environment are much easier than a physical environment since access to the virtual infrastructure gives you access to all of the VMs and virtualized resources," he says. "An admin can easily copy a VM onto a USB drive or laptop, for example."

As organizations think about preventing attacks such as those that plagued Shionogi Pharmaceuticals and Gucci last year, Chiu suggest they think carefully about how they institute controls such as separation of duties, which pose a bigger challenge within virtual infrastructure than traditional physical infrastructure.

"Virtualization admins have the ultimate keys to the kingdom to steal data, misconfigure systems, and wreak havoc within the data center," he says.

4. Myth: Data can be protected by wrapping access control around it and firewalling it
Whether the insiders themselves are the ones stealing data or the bad guys are manipulating clueless insiders to carry out attacks, the fact is that a few simple access controls and firewalls aren't sufficient to protect data today.

"Vulnerabilities, exploits, and social-engineering attacks get malware in, sophisticated malware gets data out over diverse channels -- FTP, email, files, encrypted payloads, steganography," says Mark Bower, vice president of product management at Voltage Security. "It’s as simple as that. It takes just one chink in the armor to open up a Pandora's box of sensitive content for a well-organized team of reconnaissance, payload drop, and command-and-control experts -- probably offshore and at arm’s length of the law."

He argues that the only way to really protect the data is by taking a data-centric approach that relies on protections such as encryption to make data useless to attackers.

"Data-centric protection as prevention, engineered into applications and IT policy, needs to be the No. 1 item on CISOs’ shopping lists," Bower says. "The question that should be being asked is not how to prevent a breach, but how to contain the fallout when it happens."

5. Myth: Monitoring employees always reduces risks
Monitoring is hardly a panacea for reducing insider risks for organizations. While many organizations today have instituted some form of employee monitoring, when this technology is improperly applied it may as well not even exist.

"We go in very often after something terrible happens and say we need to look at the log files to see what happened. And sometimes we have clients who say, 'We have logs,'" Brill says. "We say, 'Great, how far back do they go?' and they say '48 hours.' The problem is the incident occurred two weeks ago."

Chiu agrees that this is a common type of scenario, noting that organizations are also stymied from the use of difficult-to-track root accounts and a lack of centralized SIEM tools to alert them when bad things are happening.

"Most companies have inadequate logging to detect insider breaches within their environments," he says.

And even if the controls are correctly implemented to track behavior, they may also be introducing undue legal risks to the party.

"The growth in monitoring employee behavior in digital environments is increasingly enabled by new technology and services," said Andrew Walls, research vice president of Gartner. "Surveillance of individuals, however, can both mitigate and create risk, which must be managed carefully to comply with ethical and legal standards."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "This is the last time we hire Game of Thrones Security"
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17185
PUBLISHED: 2019-12-09
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2019-12424
PUBLISHED: 2019-12-09
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2019-18380
PUBLISHED: 2019-12-09
Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat actor to create or modify application user accounts without proper authentication.
CVE-2019-19687
PUBLISHED: 2019-12-09
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, whic...
CVE-2019-19682
PUBLISHED: 2019-12-09
nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the ...