{"id":35765,"date":"2019-11-28T11:54:36","date_gmt":"2019-11-28T11:54:36","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=35765"},"modified":"2019-12-02T10:51:01","modified_gmt":"2019-12-02T10:51:01","slug":"industry-experts-discuss-protecting-against-insider-threats","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/11\/28\/industry-experts-discuss-protecting-against-insider-threats\/","title":{"rendered":"Industry experts discuss protecting against insider threats"},"content":{"rendered":"\n<p>Gurucul, a leader in behaviour-based security and fraud\nanalytics technology for on-premises and the cloud, has announced that nearly\nhalf of the companies surveyed for its&nbsp;<em>2020 Insider Threat Report<\/em>&nbsp;are unable to remediate insider threats\nuntil after data loss has occurred.<\/p>\n\n\n\n<p>The Cybersecurity Insiders and Gurucul study found that lack\nof visibility into anomalous activity, especially in the cloud and manual SIEM\nworkloads have increased the risk of insider threats for organisations and\nprevent many from detecting and stopping data exfiltration.<\/p>\n\n\n\n<p>This&nbsp;<em>2020 Insider Threat Report&nbsp;<\/em>was\nproduced with the support of Gurucul by Cybersecurity Insiders, the 400,000-member\ncommunity for information security professionals, to explore how organisations\nare responding to evolving security threats.<\/p>\n\n\n\n<p>Some of the report\u2019s key findings include:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A total of 68% of\norganisations feel vulnerable to insider attacks<\/li><li>A total of 53% of organisations believe\ndetecting insider attacks has become significantly to&nbsp;somewhat harder\nsince migrating to the cloud<\/li><li>A total of 63% of organisations think that\nprivileged IT users pose the biggest insider security risk&nbsp;to\norganisations<\/li><li>Organisations cite lack of resources (31%) and\ntoo many false positive alerts (22%) as the biggest hurdles in maximising the\nvalue of SIEM technology<\/li><li>Only about one third of organisations are able\nto detect anomalous behaviour in NetFlow\/packet data (35%), service accounts\n(39%) and cloud resources (30%)<\/li><\/ul>\n\n\n\n<p>\u201cInsider threats are not limited to employees. They extend\nto contractors, supply chain partners, service providers and account compromise\nattacks that can abuse access to an organisation\u2019s assets both on-premise and\nin the cloud,\u201d said Craig Cooper, COO of Gurucul.<\/p>\n\n\n\n<p>\u201cLack of visibility and legacy SIEM\ndeployments put companies at risk. Insider threat programs that monitor\nthe behaviour of users and devices to detect when they deviate from their\nbaselines using security analytics can provide unmatched detection, risk-based\ncontrols and automation.\u201d<\/p>\n\n\n\n<p>Gurucul provides security analytics solutions that can\npredict, detect and prevent insider threats. The Gurucul Risk Analytics (GRA)\nplatform monitors in real-time the actions performed by users, particularly\nthose with elevated privileges and employees with access to highly sensitive\ninformation.<\/p>\n\n\n\n<p>GRA looks for behaviours that are outside the range of\nnormal, baselined activities to detect indicators of malicious insiders or\nexternal intruders who compromised a user\u2019s account.<\/p>\n\n\n\n<p>Download the full report at&nbsp;<a href=\"https:\/\/u7061146.ct.sendgrid.net\/wf\/click?upn=84Em28S1K9SvtzcUtu04EgCQNUDwqTGg7cSI9phtmfTIwCx9TJH8YYed49-2B4osAzDSIMOYvJVcTq2-2F4CbhIzCA-3D-3D_4vIR22T7oKj7v-2Fzf93WlHF9BulURs9DEMYAhHv4rxOu1tZ2sOUAqbhJNOnVJkJ-2FW1lXRdcL-2Bqo90T-2BVn6yRUDMpAiBKbVkxDKlLd7qBJ-2BB5yu54FTM6tZvaleo9Mcjrnn-2FWkYyhDv9QKMBi9MIxvH9GgAcoJvCyfDDi8HoDNGwkEurOMZSXyDUaXwv5JxV7YTQrf0vLqAZDXQg5creQ6S67T3u3saq-2FYV7QEtK7e6yt9gTW1wwS9BfSO8YAj-2BzpVx0VMpcndzARGXw1ivKGU-2BA9PhgRbS68hhAlcSVzKRnhIqLwGWYysuyMNcCcqiCqu-2FQX51KL9x7AQ9w4NaJc8E4C96wQiIFHINPRKlYF-2BFTc-3D\"><em>gurucul.com\/2020-insider-threat-survey-report<\/em><\/a><\/p>\n\n\n\n<p><em>We hear from a number of IT experts who comment on how to tackle the insider threat.<\/em><\/p>\n\n\n\n<p><strong>Rashid Ali, UK Enterprise Sales Manager at Wallix <\/strong><\/p>\n\n\n\n<p>As businesses\npour time, money and resources into tackling external cyberthreats, it is also\nfundamental to protect against threats within the organisation itself. In fact,\ndespite hackers and ransomware grabbing a lot of media attention, insider\nthreats are the leading cause of cyberattacks. <\/p>\n\n\n\n<p>While the term \u2018insider\nthreat\u2019 immediately makes us think of a disgruntled employee with malicious\nintent, the reality is that these threats can come in all different shapes and\nsizes. Simply put, anyone with privileged access to critical business systems\nrepresents some form of security risk to the organisation. These insiders can\nbe company executives, HR managers, IT admins or even third-party vendors. While\neach team member might be valued and trusted, not all breaches are intentional.\nThe vast majority of cybersecurity breaches are in fact accidental \u2013 meaning\neven the most trusted of employees pose a security threat. So how can we\nsafeguard against human error?<\/p>\n\n\n\n<p>Organisations need\nto implement a comprehensive security strategy that encompasses all areas of\nthe business to provide control and access restrictions. This should filter\ndown throughout all the infrastructure layers, including cloud-based systems,\non-premises storage and backup servers. This way, even privileged credentials\nhave limited access &#8211; meaning that if an error does occur or passwords are stolen\/hacked,\nthe breach will also be restricted. <\/p>\n\n\n\n<p>By implementing a\nform of privileged access management, businesses will be able to centralise\naccount security operations, encrypt passwords and control user access \u2013\nenhancing the security measures placed around privileged accounts. It\u2019s also\nessential to ensure that any privileged access management solution is\nseamlessly integrated \u2013 continuing to give employees the same flexibility and\nsupport to work in the most efficient way possible. While security is a top\nconcern for company CISOs and CIOs, employees day-to-day\nare faced with time constraints and sometimes see added layers and multiple\npassword requests as a trade-off between efficiency and security. This is not\nnecessarily the case so it\u2019s\nimportant to implement a platform that supports both security and workflow\nproductivity. <\/p>\n\n\n\n<p>With an integrated privileged access management solution, organisations can balance the need to safeguard against cyberthreats, fundamentally improving overall cybersecurity protocol, while enabling a productive and agile workforce. The reality is that anyone with access is a risk to the business \u2013 so safeguarding the network and data is fundamental. <\/p>\n\n\n\n<p><strong>John Crossno, Product Manager at Compuware<\/strong><\/p>\n\n\n\n<p>Due to the huge implications a data breach can have,\ncompanies are investing hand over fist to secure their systems and data \u2013 Gartner expects spending on information security to reach\nUS$170.4 billion in 2022. However, much of this investment is on technologies\nto keep the bad guys out; but what happens if the attacker is operating from\nwithin the company?<\/p>\n\n\n\n<p>Worryingly, this\ntype of attack is a frequent occurrence, with 34% of all breaches involving insider actors. Insider threats are so much harder to detect,\nas on the surface, the perpetrators\u2019 actions appear legitimate. There is also the challenge of monitoring\nthe access and usage of much of an organisation\u2019s personally identifiable\ninformation, given that for large organisations, it usually resides on the\nmainframe. The mainframe brings the advantage of being a highly securable data\nrepository, which is incredibly difficult to breach. Equally though, if an\ninsider does breach the mainframe, the results can be severe. <\/p>\n\n\n\n<p>To protect against\ninsider threats on the mainframe, organisations need to have the right systems\nand processes in place, as\nthe platform is an incredibly complex rabbit warren of databases. So much so,\nthat research from Compuware revealed that this complexity has created a\nsecurity blind-spot for 84% of organisations, who say it is difficult to\nmonitor which employees are accessing which mainframe data and what they are\ndoing with it. As a result, when investigating suspicious or malicious employee\nbehaviour, security teams have a sketchy, incomplete view.<\/p>\n\n\n\n<p>The only\neffective way of protecting the hugely valuable and sensitive data that resides\non the mainframe from insider threats is to capture a complete picture of\nmainframe user activity in real-time. Organisations need insight into which\nusers are accessing what information and when, in addition to which\napplications they are accessing, what data, and how the data is manipulated.\nThis granular level of insight can only be obtained by directly capturing\ncomplete start-to-finish user session activity data in real-time and\nintegrating it into a SIEM system such as Splunk and CorreLog, so it can be\nanalysed for patterns that are out of line with normal employee behaviour.<\/p>\n\n\n\n<p>With this approach, organisations will have the ability to spot malicious employees or unwelcome insiders at the crime scene and in the early stages of a data breach. That\u2019s a win-win for security teams and those whose personal data they are entrusted with protecting alike, going a long way towards ensuring an organisation doesn\u2019t just become another statistic on the rapidly lengthening list of data breach incidents.<\/p>\n\n\n\n<p><strong>Ray Pompon, Principal Threat Research Evangelist, F5 Networks <\/strong><\/p>\n\n\n\n<p>The <em>2019 F5\nLabs Application Protection<\/em> report revealed that 14% of all\nbreaches were directly attributable to employee accidents and a further 20%\nwere lost to employee negligence related to storage of confidential data in\nemail. That doesn&#8217;t consider the additional 22% of 2019 breaches resulting from\nemployees being duped by phishing. In other words, billions of personal records\nwere put at risk by \u2018inadvertent insiders\u2019. It is a prickly problem and one\nthat is only going to get worse as multi-cloud deployment scenarios become\noperational prerequisites. Alarmingly, F5 Labs noted over 27 major leaks in\ncloud and cloud databases in the past three years directly caused by\nmisconfiguration of access controls. Nearly half of those happened in\n2019. As more organisations race to the cloud, more accidents are occurring.\nConsidering how easy cloud systems are to use, it&#8217;s no surprise. It doesn&#8217;t\ntake much engineering skill for someone to populate a cloud database, secure or\nnot, and get started on the new gold rush. Gartner has predicted that, \u2018through\n2025, 99% of cloud security failures will be the customer\u2019s fault\u2019.<\/p>\n\n\n\n<p>When it comes to better\ntracking employees to reduce insider threats, organisations need to consider\nboth the malicious and accidental insider. Most companies provide access to\ncorporate data (internal apps, email) through staff-owned devices, yet aside\nfrom setting basic screen lock requirements, few actually control the data that goes onto\nthese devices. Corporate and personal data\nis now everywhere \u2013 spread across internal\napplications and the multi-cloud. Organisations\nneed to ensure that, beyond simply tracking devices, they have proper data\ngovernance in place and that they enforce\nconsistent security policies regardless of where the app and data reside.<\/p>\n\n\n\n<p>Businesses also need to realise\nthat policy, more than technology, will be key to success. Organisations\nmust understand the entire data lifecycle for all of their apps: who owns the data, who has access, how it is\nretrieved and how is it deleted. <\/p>\n\n\n\n<p>Phishing\nwill remain one of the most common and most successful forms of accidental\ninsider breaches and cyberattacks for the foreseeable future, and that&#8217;s simply\nbecause it doesn&#8217;t inherently rely on a weakness in technology. Phishing and\nspear-phishing attacks continue to evolve and are no longer crude and easy to\nspot. Organised cybercrime groups and nation-states expend significant effort\nto understand their victims and take advantage of social engineering\ntechniques. Education is critical and can reduce the success of phishing\nattacks by a third, but technology needs to support us. There must be a move\naway from password-based authentication schemes and until we reach that point,\nmulti-factor should be used absolutely everywhere.<\/p>\n\n\n\n<p>Ultimately, business leaders need to improve at leading by example and supporting continually evolving awareness-raising programmes. They also need to ensure existing defence postures are rigorously interrogated and enhanced to cope with ever-expanding attack surfaces and increasingly ingenious cybercriminal activity.<\/p>\n\n\n\n<p><strong>Karl Lankford, Director of Solutions Engineering, Beyond Trust<\/strong><\/p>\n\n\n\n<p>When we think of insider threats, we often imagine\ndisgruntled employees seeking revenge on their former employers\u2019 business. In\nreality, a vast majority of these threats are most often caused by honest\nmistakes such as clicking on malicious links or opening phishing emails.<\/p>\n\n\n\n<p>Either way, insider threats can be\nvery difficult to detect and pose a threat that businesses struggle to address.\n<\/p>\n\n\n\n<p>In fact, in our&nbsp;<a href=\"https:\/\/www.beyondtrust.com\/resources\/whitepapers\/privileged-access-threat-report\"><em>Privileged Access Threat Report<\/em><\/a>&nbsp;from this year, we revealed\nthat two-thirds of IT professionals believe their organisation has likely had\neither a direct or indirect breach due to employee access in the last 12\nmonths, with 58% treating the threat of misused or abused insider access as\ncritical.&nbsp;<\/p>\n\n\n\n<p>So how can organisations ensure they\u2019re effectively protecting themselves to address this risk? Here are my top tips on combating the insider threat.<\/p>\n\n\n\n<p><strong>Control or eradicate email attachments and links<\/strong>&nbsp;<strong>&#8211;<\/strong> Emails are the primary attack vectors in use today and while a message in itself may not be dangerous, links and attachments are. Today\u2019s security product vendors are offering real-time malware assessment of links and attachments and will quarantine a suspicious attachment and prevent connecting to a dangerous link.<\/p>\n\n\n\n<p><strong>Properly manage and control access to data and critical systems&nbsp;&#8211;<\/strong> Role-based permission, removal of administrator access and the principle of least privilege are your friends. Work with your HR team and line of business managers to understand user roles and the types of application and data access they need to do their jobs. Then, assign only that access level and no more. Take advantage of identity governance and PAM solutions to effectively manage role-based permissions for onboarding, role changes and offboarding, and removing access when employees leave the business.<\/p>\n\n\n\n<p><strong>Know where your data is&nbsp;&#8211;<\/strong> An important counterpart to my second tip is knowing where mission-critical and sensitive data resides in the system so you can lock it down with appropriate permissions. If you don\u2019t know where it is, how can you protect it with the right level of access?<\/p>\n\n\n\n<p><strong>Monitor employee behaviour and look for anomalies&nbsp;&#8211;<\/strong> This can be done at many levels, including action monitoring software. It\u2019s not intrusive to look for excessive data dumps or repeated attempts to look at files or directories that are not permitted, it\u2019s good business.<\/p>\n\n\n\n<p><strong>Raise security awareness &#8211;<\/strong>&nbsp;Finally,\nthere is the need for ongoing security awareness training that is an integral\npart of company culture and not an afterthought or a \u2018checklist\u2019 item. A\ncompany that partners with employees to ensure security awareness will do\nbetter than one that forces compliance or just performs training to check a\nbox.<\/p>\n\n\n\n<p>However, the challenge of mitigating insider threats is\nthat most organisations don\u2019t have fully integrated privileged access\nmanagement (PAM) tools.<\/p>\n\n\n\n<p>I\u2019ll leave you with this important point. While evaluating\nattack vectors, researching competitors and gauging the threat from organised\ncrime or foreign adversaries, it\u2019s easy to conclude that external attacks\nshould be the primary focus of defence. This conclusion can often be wrong. The critical element is not the source of a threat, but its\npotential for damage.<\/p>\n\n\n\n<p>By evaluating threats from this perspective, it becomes obvious that although most attacks might come from outside the organisation, the most serious damage is done with help from the inside.<\/p>\n\n\n\n<p><strong>Javvad Malik, Security Awareness Advocate at KnowBe4<\/strong><\/p>\n\n\n\n<p>Insider\nthreats is a term used to combine a number of threats and can mean many things.<\/p>\n\n\n\n<p>At a\nbroad level, there are three main types of threats which form an insider threat.\nA malicious insider, a non-malicious insider and a compromised insider.&nbsp;<\/p>\n\n\n\n<p>Malicious\nusers are aware of their actions and the negative implications on the\norganisation, yet still pursue that course of action.&nbsp;<\/p>\n\n\n\n<p>It\ncan include users who take company information when moving jobs or disgruntled\nusers who want to damage the company.&nbsp;<\/p>\n\n\n\n<p>At\nthe extreme end are employees engaged in corporate espionage. Providing\nintellectual property or other sensitive information to competitors, criminal\ngangs or nation-state sponsored actors.<\/p>\n\n\n\n<p>Non-malicious\ninsiders are those users that perform actions which have no ill intent but can\nnevertheless cause harm to an organisation. For example, shadow IT, where users\nwill procure or use a cloud application such as a file-sharing app to increase\nproductivity, but inadvertently expose the company.<\/p>\n\n\n\n<p>The final, often overlooked, category is that of compromised insiders. Typically, this is where credentials have been guessed or captured as part of a targeted attack. Although the actor behind the account is not an employee, the use of legitimate credentials would show up as if it were an employee.&nbsp;<\/p>\n\n\n\n<p>As\ninsiders form a variety of threats, a layered approach should be taken. This\nincludes technical controls which can look at user behaviour and raise alarms\nwhere something appears out of the ordinary, such as a large transfer of files\nto external destinations.&nbsp;<\/p>\n\n\n\n<p>When dealing with\nhumans, often the best detection and remedial action is\nhaving a strong security culture within the organisation so that people\nthemselves can help to identify any issues.\nFor example, it is rare to see an employee become disgruntled overnight and\ncome in to cause harm the next day. So, having good line managers that can spot\nthe signs early and who can help affected employees would be a far more\neffective approach than relying on technology alone.<\/p>\n\n\n\n<p>Ultimately,\nit\u2019s a delicate balancing act. At the moment, technology is not sufficiently\nadvanced to fully understand humans and make rational decisions, which is why,\nin today\u2019s enterprise, everyone has a role to play in ensuring the security of\nthe organisation, and their colleagues. Neglecting to foster a security culture and ignoring the\nhuman element is a mistake no company can make in this day and age.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gurucul, a leader in behaviour-based security and fraud analytics technology for on-premises and the cloud, has announced that nearly half of the companies surveyed for its&nbsp;2020 Insider Threat Report&nbsp;are unable to remediate insider threats until after data loss has occurred. The Cybersecurity Insiders and Gurucul study found that lack of visibility into anomalous activity, especially [&hellip;]<\/p>\n","protected":false},"author":21,"featured_media":35766,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[57,1489,93,24],"tags":[13970,1257,12853,3677,13809,13825,12283,13969],"class_list":["post-35765","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-insights","category-top-stories","category-used","tag-beyond-trust","tag-cybercriminals","tag-cybersecurity-insiders","tag-f5-networks","tag-gurucul","tag-insider-threats","tag-knowbe4","tag-wallix"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=35765"}],"version-history":[{"count":7,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35765\/revisions"}],"predecessor-version":[{"id":35788,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/35765\/revisions\/35788"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/35766"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=35765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=35765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=35765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}