Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/29/2012
06:24 PM
50%
50%

Top 5 Myths About Insider Threats

Myths about who insiders are and how they're putting data at risk keep mitigation efforts at bay

Misconceptions and misunderstandings abound when it comes to insider threats. Many organizations fail to identify the scope and severity of risk posed by insiders because they adhere to mistaken beliefs about what kind of insiders present danger to their organizations and how. Similarly, misapprehension about security controls further adds to misapplied mitigation efforts.

If organizations are to work on reducing insider risks, then they first need to bust the myths around them that could be holding back their progress.

1. Myth: The majority of internal data breaches are intentional
This is one of the most common insider myths out there, says Alan Brill, senior managing director of Kroll Advisory Solutions.

"At any given moment, there's a portion of population that's up to no good, but it's a small percentage," Brill says. "Generally, people want to do the right thing."

The only problem is that if an organization doesn't tell these otherwise good people what the wrong thing is, they may not know it, he says. Often employees put business data at risk for convenience sake -- for example, to load a thumb drive with sensitive customer files or valuable schematics into a public cloud storage service like Dropbox so they can work from home.

"The majority of cases you ultimately see are traced back not to a deliberate desire to hurt the company or do something illegal or immoral, but for some kind of purpose with good intentions," Brill says. "But they always say that the road to hell is paved in good intentions."

[ Making the case against an insider takes preparation and proactive work with HR and legal. See 5 Ways To Lose A Malicious Insider Lawsuit. ]

2. Myth: Insider threats are limited to the organization’s employees
Employees are not the only insiders organizations need to worry about, Brill warns.

"You look at organizations and see that they don't just have employees, but they also have temps and they have contractors and they have vendors and those vendors have vendors," he says, "and they enter into various cloud arrangements [to share data] and the real question is ultimately who has access to data?"

He warns that if you can't answer that question effectively, then you have a big problem. For example, he has seen many clients with breach issues that had no policies set to centralize notification when any representative of the company entered into an outsourcing or cloud arrangement -- meaning there was no way to even know when data was moving outside the organization. This is a situation every business should avoid, he says.

"It is important to get a handle on where the sensitive data is and whether you're still responsible for it if someone else has it, and, if so, how they're protecting it and whether they're indemnifying you in any way if they screw it up," he says.

3. Myth: Securing against insider attacks in a virtualized cloud environment is the same as for a physical environment
Virtualization may have made things immeasurably easier for IT to maintain its infrastructure, but it also makes it easy for insiders to pilfer information, says Eric Chiu, president and founder of HyTrust. The centralized, compact nature of VMs provide a perfect "to-go" package for malicious insiders to easily steal a greater concentration of information.

"Insider attacks within a virtualized environment are much easier than a physical environment since access to the virtual infrastructure gives you access to all of the VMs and virtualized resources," he says. "An admin can easily copy a VM onto a USB drive or laptop, for example."

As organizations think about preventing attacks such as those that plagued Shionogi Pharmaceuticals and Gucci last year, Chiu suggest they think carefully about how they institute controls such as separation of duties, which pose a bigger challenge within virtual infrastructure than traditional physical infrastructure.

"Virtualization admins have the ultimate keys to the kingdom to steal data, misconfigure systems, and wreak havoc within the data center," he says.

4. Myth: Data can be protected by wrapping access control around it and firewalling it
Whether the insiders themselves are the ones stealing data or the bad guys are manipulating clueless insiders to carry out attacks, the fact is that a few simple access controls and firewalls aren't sufficient to protect data today.

"Vulnerabilities, exploits, and social-engineering attacks get malware in, sophisticated malware gets data out over diverse channels -- FTP, email, files, encrypted payloads, steganography," says Mark Bower, vice president of product management at Voltage Security. "It’s as simple as that. It takes just one chink in the armor to open up a Pandora's box of sensitive content for a well-organized team of reconnaissance, payload drop, and command-and-control experts -- probably offshore and at arm’s length of the law."

He argues that the only way to really protect the data is by taking a data-centric approach that relies on protections such as encryption to make data useless to attackers.

"Data-centric protection as prevention, engineered into applications and IT policy, needs to be the No. 1 item on CISOs’ shopping lists," Bower says. "The question that should be being asked is not how to prevent a breach, but how to contain the fallout when it happens."

5. Myth: Monitoring employees always reduces risks
Monitoring is hardly a panacea for reducing insider risks for organizations. While many organizations today have instituted some form of employee monitoring, when this technology is improperly applied it may as well not even exist.

"We go in very often after something terrible happens and say we need to look at the log files to see what happened. And sometimes we have clients who say, 'We have logs,'" Brill says. "We say, 'Great, how far back do they go?' and they say '48 hours.' The problem is the incident occurred two weeks ago."

Chiu agrees that this is a common type of scenario, noting that organizations are also stymied from the use of difficult-to-track root accounts and a lack of centralized SIEM tools to alert them when bad things are happening.

"Most companies have inadequate logging to detect insider breaches within their environments," he says.

And even if the controls are correctly implemented to track behavior, they may also be introducing undue legal risks to the party.

"The growth in monitoring employee behavior in digital environments is increasingly enabled by new technology and services," said Andrew Walls, research vice president of Gartner. "Surveillance of individuals, however, can both mitigate and create risk, which must be managed carefully to comply with ethical and legal standards."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21354
PUBLISHED: 2021-03-08
Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of "https://pollbot.services.mozilla.com...
CVE-2021-21362
PUBLISHED: 2021-03-08
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses ...
CVE-2020-4695
PUBLISHED: 2021-03-08
IBM API Connect V10 is impacted by insecure communications during database replication. As the data replication happens over insecure communication channels, an attacker can view unencrypted data leading to a loss of confidentiality.
CVE-2020-4903
PUBLISHED: 2021-03-08
IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user or obtain sensitive information. IBM X-Force ID: 191105.
CVE-2020-5014
PUBLISHED: 2021-03-08
IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. IBM X-Force ID: 193247.