Misconceptions and misunderstandings abound when it comes to insider threats. Many organizations fail to identify the scope and severity of risk posed by insiders because they adhere to mistaken beliefs about what kind of insiders present danger to their organizations and how. Similarly, misapprehension about security controls further adds to misapplied mitigation efforts.

If organizations are to work on reducing insider risks, then they first need to bust the myths around them that could be holding back their progress.

1. Myth: The majority of internal data breaches are intentional
This is one of the most common insider myths out there, says Alan Brill, senior managing director of Kroll Advisory Solutions.

"At any given moment, there's a portion of population that's up to no good, but it's a small percentage," Brill says. "Generally, people want to do the right thing."

The only problem is that if an organization doesn't tell these otherwise good people what the wrong thing is, they may not know it, he says. Often employees put business data at risk for convenience sake -- for example, to load a thumb drive with sensitive customer files or valuable schematics into a public cloud storage service like Dropbox so they can work from home.

"The majority of cases you ultimately see are traced back not to a deliberate desire to hurt the company or do something illegal or immoral, but for some kind of purpose with good intentions," Brill says. "But they always say that the road to hell is paved in good intentions."

[ Making the case against an insider takes preparation and proactive work with HR and legal. See 5 Ways To Lose A Malicious Insider Lawsuit. ]

2. Myth: Insider threats are limited to the organization’s employees
Employees are not the only insiders organizations need to worry about, Brill warns.

"You look at organizations and see that they don't just have employees, but they also have temps and they have contractors and they have vendors and those vendors have vendors," he says, "and they enter into various cloud arrangements [to share data] and the real question is ultimately who has access to data?"

He warns that if you can't answer that question effectively, then you have a big problem. For example, he has seen many clients with breach issues that had no policies set to centralize notification when any representative of the company entered into an outsourcing or cloud arrangement -- meaning there was no way to even know when data was moving outside the organization. This is a situation every business should avoid, he says.

"It is important to get a handle on where the sensitive data is and whether you're still responsible for it if someone else has it, and, if so, how they're protecting it and whether they're indemnifying you in any way if they screw it up," he says.

3. Myth: Securing against insider attacks in a virtualized cloud environment is the same as for a physical environment
Virtualization may have made things immeasurably easier for IT to maintain its infrastructure, but it also makes it easy for insiders to pilfer information, says Eric Chiu, president and founder of HyTrust. The centralized, compact nature of VMs provide a perfect "to-go" package for malicious insiders to easily steal a greater concentration of information.

"Insider attacks within a virtualized environment are much easier than a physical environment since access to the virtual infrastructure gives you access to all of the VMs and virtualized resources," he says. "An admin can easily copy a VM onto a USB drive or laptop, for example."

As organizations think about preventing attacks such as those that plagued Shionogi Pharmaceuticals and Gucci last year, Chiu suggest they think carefully about how they institute controls such as separation of duties, which pose a bigger challenge within virtual infrastructure than traditional physical infrastructure.

"Virtualization admins have the ultimate keys to the kingdom to steal data, misconfigure systems, and wreak havoc within the data center," he says.

4. Myth: Data can be protected by wrapping access control around it and firewalling it
Whether the insiders themselves are the ones stealing data or the bad guys are manipulating clueless insiders to carry out attacks, the fact is that a few simple access controls and firewalls aren't sufficient to protect data today.

"Vulnerabilities, exploits, and social-engineering attacks get malware in, sophisticated malware gets data out over diverse channels -- FTP, email, files, encrypted payloads, steganography," says Mark Bower, vice president of product management at Voltage Security. "It’s as simple as that. It takes just one chink in the armor to open up a Pandora's box of sensitive content for a well-organized team of reconnaissance, payload drop, and command-and-control experts -- probably offshore and at arm’s length of the law."

He argues that the only way to really protect the data is by taking a data-centric approach that relies on protections such as encryption to make data useless to attackers.

"Data-centric protection as prevention, engineered into applications and IT policy, needs to be the No. 1 item on CISOs’ shopping lists," Bower says. "The question that should be being asked is not how to prevent a breach, but how to contain the fallout when it happens."

5. Myth: Monitoring employees always reduces risks
Monitoring is hardly a panacea for reducing insider risks for organizations. While many organizations today have instituted some form of employee monitoring, when this technology is improperly applied it may as well not even exist.

"We go in very often after something terrible happens and say we need to look at the log files to see what happened. And sometimes we have clients who say, 'We have logs,'" Brill says. "We say, 'Great, how far back do they go?' and they say '48 hours.' The problem is the incident occurred two weeks ago."

Chiu agrees that this is a common type of scenario, noting that organizations are also stymied from the use of difficult-to-track root accounts and a lack of centralized SIEM tools to alert them when bad things are happening.

"Most companies have inadequate logging to detect insider breaches within their environments," he says.

And even if the controls are correctly implemented to track behavior, they may also be introducing undue legal risks to the party.

"The growth in monitoring employee behavior in digital environments is increasingly enabled by new technology and services," said Andrew Walls, research vice president of Gartner. "Surveillance of individuals, however, can both mitigate and create risk, which must be managed carefully to comply with ethical and legal standards."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.