Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

06:24 PM

Top 5 Myths About Insider Threats

Myths about who insiders are and how they're putting data at risk keep mitigation efforts at bay

Misconceptions and misunderstandings abound when it comes to insider threats. Many organizations fail to identify the scope and severity of risk posed by insiders because they adhere to mistaken beliefs about what kind of insiders present danger to their organizations and how. Similarly, misapprehension about security controls further adds to misapplied mitigation efforts.

If organizations are to work on reducing insider risks, then they first need to bust the myths around them that could be holding back their progress.

1. Myth: The majority of internal data breaches are intentional
This is one of the most common insider myths out there, says Alan Brill, senior managing director of Kroll Advisory Solutions.

"At any given moment, there's a portion of population that's up to no good, but it's a small percentage," Brill says. "Generally, people want to do the right thing."

The only problem is that if an organization doesn't tell these otherwise good people what the wrong thing is, they may not know it, he says. Often employees put business data at risk for convenience sake -- for example, to load a thumb drive with sensitive customer files or valuable schematics into a public cloud storage service like Dropbox so they can work from home.

"The majority of cases you ultimately see are traced back not to a deliberate desire to hurt the company or do something illegal or immoral, but for some kind of purpose with good intentions," Brill says. "But they always say that the road to hell is paved in good intentions."

[ Making the case against an insider takes preparation and proactive work with HR and legal. See 5 Ways To Lose A Malicious Insider Lawsuit. ]

2. Myth: Insider threats are limited to the organization’s employees
Employees are not the only insiders organizations need to worry about, Brill warns.

"You look at organizations and see that they don't just have employees, but they also have temps and they have contractors and they have vendors and those vendors have vendors," he says, "and they enter into various cloud arrangements [to share data] and the real question is ultimately who has access to data?"

He warns that if you can't answer that question effectively, then you have a big problem. For example, he has seen many clients with breach issues that had no policies set to centralize notification when any representative of the company entered into an outsourcing or cloud arrangement -- meaning there was no way to even know when data was moving outside the organization. This is a situation every business should avoid, he says.

"It is important to get a handle on where the sensitive data is and whether you're still responsible for it if someone else has it, and, if so, how they're protecting it and whether they're indemnifying you in any way if they screw it up," he says.

3. Myth: Securing against insider attacks in a virtualized cloud environment is the same as for a physical environment
Virtualization may have made things immeasurably easier for IT to maintain its infrastructure, but it also makes it easy for insiders to pilfer information, says Eric Chiu, president and founder of HyTrust. The centralized, compact nature of VMs provide a perfect "to-go" package for malicious insiders to easily steal a greater concentration of information.

"Insider attacks within a virtualized environment are much easier than a physical environment since access to the virtual infrastructure gives you access to all of the VMs and virtualized resources," he says. "An admin can easily copy a VM onto a USB drive or laptop, for example."

As organizations think about preventing attacks such as those that plagued Shionogi Pharmaceuticals and Gucci last year, Chiu suggest they think carefully about how they institute controls such as separation of duties, which pose a bigger challenge within virtual infrastructure than traditional physical infrastructure.

"Virtualization admins have the ultimate keys to the kingdom to steal data, misconfigure systems, and wreak havoc within the data center," he says.

4. Myth: Data can be protected by wrapping access control around it and firewalling it
Whether the insiders themselves are the ones stealing data or the bad guys are manipulating clueless insiders to carry out attacks, the fact is that a few simple access controls and firewalls aren't sufficient to protect data today.

"Vulnerabilities, exploits, and social-engineering attacks get malware in, sophisticated malware gets data out over diverse channels -- FTP, email, files, encrypted payloads, steganography," says Mark Bower, vice president of product management at Voltage Security. "It’s as simple as that. It takes just one chink in the armor to open up a Pandora's box of sensitive content for a well-organized team of reconnaissance, payload drop, and command-and-control experts -- probably offshore and at arm’s length of the law."

He argues that the only way to really protect the data is by taking a data-centric approach that relies on protections such as encryption to make data useless to attackers.

"Data-centric protection as prevention, engineered into applications and IT policy, needs to be the No. 1 item on CISOs’ shopping lists," Bower says. "The question that should be being asked is not how to prevent a breach, but how to contain the fallout when it happens."

5. Myth: Monitoring employees always reduces risks
Monitoring is hardly a panacea for reducing insider risks for organizations. While many organizations today have instituted some form of employee monitoring, when this technology is improperly applied it may as well not even exist.

"We go in very often after something terrible happens and say we need to look at the log files to see what happened. And sometimes we have clients who say, 'We have logs,'" Brill says. "We say, 'Great, how far back do they go?' and they say '48 hours.' The problem is the incident occurred two weeks ago."

Chiu agrees that this is a common type of scenario, noting that organizations are also stymied from the use of difficult-to-track root accounts and a lack of centralized SIEM tools to alert them when bad things are happening.

"Most companies have inadequate logging to detect insider breaches within their environments," he says.

And even if the controls are correctly implemented to track behavior, they may also be introducing undue legal risks to the party.

"The growth in monitoring employee behavior in digital environments is increasingly enabled by new technology and services," said Andrew Walls, research vice president of Gartner. "Surveillance of individuals, however, can both mitigate and create risk, which must be managed carefully to comply with ethical and legal standards."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-12
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover pa...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.