Hi everyone this is Millie Law and today’s topic is managing insider threat
Our agenda is first to introduce and define insider threat Then I will talk about the key risk factors and the according managing strategies I will talk about the current issues facing insider risk management and then I will give the conclusion
Insider threat is defined as attacks from within the organization by individuals who have unintentionally or intentionally caused the loss of organizational assets Insider threat is identified as one of the top three macro security issues today for organizations. insiders were responsible for 69% of database breaches. In the 2010 e-Crime Survey, relative to external breaches, incidents of insider attack are often more costly to organizations. A Sprint employee who cloned customer data using a low-tech breach technique had caused Sprint to lose US$15M and to lay off 80 employees. Additionally, $700M loss was caused by a complex financial fraud committed by an insider in a financial institution
Deloitte UK identified four major areas that are susceptible to insider threat, including (1) Damage and (2) Theft of key assets and critical equipment (3) Massive deleting/corrupting files and records (4) Exposure and leakage of information that is sensitive
Researchers have shown that C-suite executives lack insight and understanding of insider threat and its implications, such as decrease in competitiveness, efficiency, compliance, and security. Mitigation of insider threats is often not a top priority for executives because they see it as a “high impact, very low-frequency issue According to the Secure Computing IT Director Survey, only 35% of the organizations surveyed placed internal security as a priority in planned investment despite the economic downturn. According to a Deloitte survey for Fortune 1000 companies, 9 of 10 executives believed that security and privacy are primarily a technology problem, so they believe the IT department should take full responsibility for finding a solution The technical manager of Computer Emergency Response Team (CERT) exclaimed that it has been difficult to convince the C-suite executives that insider threat is not just an IT problem. This implies that executives do not understand that insider threat pervades the business process and that is not just a technology problem
The Enterprise Security Program (ESP) is an effective system which directs an organization to establish the security tone at the top. The objective of the ESP is the sustainability of a pervasive culture of security in the organization’s beliefs, behaviors, capabilities, and actions. This is achieved by implementing top-level policies and an effective governance structure The executive team sets up top-level security policies, establishes the risk thresholds for the organization, obtains funds for the ESP, and creates the X-team. The X-team comprises of sub-teams which are responsible for day-to-day IT security operations The executive team and the X-team should focus on conducting regular reviews of processes that are governed by the policies described above for their effectiveness and efficiency.
More than 27% of insiders studied stated that they were experiencing financial difficulty when the incident occurred. For instance, a cell phone number is sold for £10.00 each ron the black market according to the FBI. There are four types of data which are quite lucrative and are often stolen by insiders Since individual financial crisis is usually the motivating factor behind insider attacks, organizations should not underestimate the return on investments in employee assistance programs (EAP), according to a study conducted by Deloitte. An effective and well-funded EAP provides guidance and support to employees, emotionally and financially. When an employee who is facing financial crisis is helped by the program provided by the organization, it prevents employees from compromising their organization’s information for financial gain.
Lack of education and awareness remains an obstacle in mitigiting insider risk. The insider risk is introduced by employees that lack the motivation and awareness to vigorously protect the integrity and the privacy of sensitive information of the stakeholders. Information system risks can be caused by unintentional behaviors, such as forgetting to log off a workstation, failure to change passwords regularly, and inappropriately discarding of sensitive information. In 2007, more than 37% organizations experienced leakage of sensitive information through emails. In order to reduce information system risks caused by unintentional behaviors, management is responsible for identifying areas with high risk exposure and providing education. CERT’s 16 Best Practices are defensive measures to prevent or facilitate early detection of insider incidents.
Ineffective identity management, which relates to lack of accountability of access activities, increases insider risk. In order to gather information on insider threat detection pertaining to a specific organization, log collection and event correlation analysis are imperative in identifying high-risk behaviors. Any suspicious behavior, such as above average use of company’s network, should be detected, monitored, reported, and investigated The Federated Model is adopted by many large global corporations to distribute responsibility across the company’s hierarchy, ensuring that people are accountable for the safety and protection of the organization’s assets. This model has a centralized group responsible for setting common standards and coordinating functions, while business units manage ‘local’ executions. However, this model may not be suitable for small businesses, where owner-manager oversight serves as the primary risk mitigation strategy to the insider threat. Smaller organizations can consider using log management techniques with the network monitoring approach, where log files go through logical pairing, followed by log analysis and event correlation
A third of organizations have reported that employees have abused their access rights, either intentionally or accidentally The people paradox states that people within the ‘trusted’ circle of the organization are the primary threat to the organization’s assets. This paradox applies to the fact that employees are trusted by the organization with their access privileges, but many have breached the trust by misusing them.
The attribute based model defines insiders based on access attributes. The defined groups are categorized based on access capabilities, and identifies high-risk users to high-risk resources Since the users are grouped by their ability to access organizational resources using the Attributed based model, security personnel can focus on monitoring those that pose the most threat to the organization.
Another approach to mitigate insider threat caused by misused access privileges is “Identity Access Management” (IAM). IAM is the implementation of centralized and automated controls that enforce security policies by monitoring employee and third-party access and use of sensitive data in real time across multiple databases in different locations. IAM uses internal auditing to determine, amongst the stakeholders, the information that needs to be protected the most, and what kind of database application is used for storage. After defining what it means by sensitive data, stakeholders must agree to this common definition. These data are then tagged and consolidated within centralized servers protected by encryption and physical security measures. IAM applies digital rights management technology to control whether this information can be transferred outbound of the server, while balancing the need for employees to complete their job responsibilities
Insiders have significant advantage over external attackers since insiders can bypass physical and logical security measures designed to prevent unauthorized access. Most insider attackers are aware of their insider advantage, such as vulnerabilities in internal controls, systems, and networks. Employees have realized that control mechanisms such as firewalls, intrusion-detection systems, and electronic building-access systems are usually geared towards defending against external threats. The risk of unauthorized access within the organization may be mitigated by the Honey Pot approach, which is a relatively new strategy in dealing with insider threat. Fictitious data such as credit card numbers, social security numbers, and documents are put into this ‘honey pot’ to attract unauthorized access. These unauthorized access attempts are then recorded and would be followed by punitive managerial decisions
According to the “Insider Threat Study”, insiders held different positions in the organization – there was no specific type of high-risk attackers. Contrary to the perception that the IT department is most likely to snoop around confidential information It should be stressed that the insider threat is not exclusive to IT personnel, because employees are now more technologically savvy. The employee screening process should include the best available criminal history records. To ensure accuracy, organizations can standardize the presentation of these records or hire an external agency for screening. However, background checking will not completely remove insider threat, as most attackers come to the organization without a criminal background. Hence, the screening is not a standalone process and is only effective when complemented with other security measures.
However, there are general traits which high-risk employees can identify – but security professionals should not generalize these traits but only use them as a reference source. When hiring, employers should make reference to the characteristics of a Risk-indicator and Risk-mitigator as they show the potential an employee to conduct an insider attack. Organizations should also look for competencies such as accountability and integrity for a secure workforce
Many organizations today have silo’ed physical and information system architecture. It is expensive to integrate and coordinate between physical and cyber infrastructure and assets; hence, companies shy away from this investment which increases the risk of combined fraud and theft of these properties. The risk is further increased when the organizations do not know how much data they have. For instance, only 18% of the 150 IT security professionals surveyed were certain of the exact number of sensitive files in their organizations Since maintaining these data creates significant cost for collection and storage, and carries huge potential costs in legal responsibilities, companies should conduct data inventory projects and modify their systems architecture for leaner data inventory and more efficient architecture for cost and legal liability risk reduction. The recommended data inventory project comprises of the following steps: Take inventory of sensitive files Accurately record their location on the server Keep track of access rights to these files By doing the above, the organization would be able to guard against insider threat by timely detection of the addition, removal, and improper access of these sensitive data. It should be noted that a comprehensive data inventory project must be acted on before an adverse event in order to maximize its benefits.
In addition to the data inventory project, companies should implement the data-centric policy which would focus managers, auditors, and other parties to be involved in securing data under the mobile environment.
The trend for globalization has increased insider risk in multinational operating environments, especially when these environments lack guidance on how to protect against insider threats. Current research studies lack validity in international environments. Also, globalization complicates the issue of trust, and the technology and business process collaboration The insider risk regarding virtual work environment is increased as many organizations still use and rely on policies and manual controls to review user administration, segregation of duties, etc. However, the issue is that there are a lack of tested and practical strategies to minimize insider threat for these ‘cloud-based’ work environments.
Managing insider threat should be a priority, especially for C-suite executives when they are the one responsible to institute a security conscious tone at the top – There are best practicses guidelines and various managing strategies which small to large organizations can use to establish policies and control procedures to address the risk factors. This concludes my presentation Thanks for listening
![[object Object],[object Object],[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)