Insider Threat Risks to Your Organization

Business owners and IT managers are well aware of the threats posted by hackers and cybercriminals to their networks, and most are taking steps to secure their organizations and to ward off these outside threats. However, sometimes the biggest threat to your company comes from within the walls of your office.

A recent study funded by the U.S. Department of Homeland Security, the U.S. Secret Service, and the CERT Insider Threat Center at Carnegie Mellon University’s Software Engineering Institute found that malicious insiders within the financial industry often get away with fraud for nearly 32 months before they are detected.

At a February presentation at RSA Conference 2013, Dawn Cappelli of the CERT Insider Threat Center presented several instances in which current and former employees damaged companies by planting malware, stealing corporate data, or colluding with outsiders to commit fraud. In fact, the center has tracked 800 insider threat cases since 2001.

Types of Insider Threats to Watch Out For

According to Cappelli, certain employees often are involved in a range of scenarios:

Cases involving intellectual property theft, such as business plans or source code, often involve a former employee who worked on the project. Often, these culprits save company information on a USB drive and are never caught.

In cases of sabotage, highly technical employees, such as system administrators who become disgruntled after being fired, often set up an attack before leaving the company.

Fraud cases typically involve lower-level support employees, such as help desk personnel, who conspire with outsiders.

Threats from untrained users or users that are not following procedures are also very real.

Potential Sources of Insider Threats

Companies that use file services like Dropbox and virtual machines should be careful, as employees can use these to exfiltrate information. One case Cappelli presented involved a product development manager who had access to clients’ trade secrets. He had access to information on two clients in the semiconductor industry and downloaded 80 documents before leaving the company and taking a job with one of these semiconductor clients. His new employer turned him over to authorities after learning about the breach, including the fact that 18 of the documents belonged to a close competitor. To protect your company from this type of threat, ensure that business partners protect information, audit their controls, and build it into contracts.

Another source of potential insider fraud is shared computers. Cappelli spoke of an instance at a university, where two students loaded malware onto publicly accessible computers so they could steal credentials and spy on student records.

In another situation at a hospital, a disgruntled security guard, who had a background in system administration, installed malware on systems. He was caught when he posted a video of his work, and another hacker reported him to the FBI.

Yet another instance involved a network engineer at a retail company who knew he was going to be fired. He created a VPN token for a fake employee before leaving the company, and then called the company’s help desk pretending to be a new employee requesting a credential activation. After lying low for a few months, the former employee deleted corporate email accounts and virtual machines, creating a major headache for the company. To protect virtual machines, companies can scan memory files and tie virtual environments into existing security systems.

Insider Threat Warning Signs

While these examples of rogue employees wreaking havoc on companies might be scary, they serve as a reminder that threats need not come from outside a business.

In a recent Tech Republic article, writer Tom Olzak shares a list of possible signs that an employee is about to go rogue, possibly creating a security risk for your company. His list includes the following:

Attempts to circumvent security controls
Unexplained, repeated absences on Monday or Friday
Pattern of disregard for rule
Long-term anger about being passed over for a promotion
Pattern of lying and deception of peers or managers
Frustration with management for not listening to what the employee considers grave concerns about security or business processes

Watch out for these signs that someone may become a threat, and communicate with that employee immediately to attempt to remedy the situation before it spirals out of control. Since employees often hide malicious behaviors from managers, training all employees to watch out for signs of discontent can help with prevention. Providing a way for employees to anonymously report peers can help them look out for your company without fear of being labeled a tattletale.

The “Accidental” Threat

While the threat of an insider intentionally compromising security to get what he or she needs is very real. industry statistics indicate that more than 52 percent of insider incidents are accidental or inadvertent. How do you guard against these? A multi-dimensional security approach is required that encompasses:

Education — educate your users about the risks of phishing attacks, social engineering attacks, and high risk behaviors such as downloading and installing unauthorized or illegal software, or sharing passwords.
Security Tools — many organizations invest in tools that can monitor in a “trust but verify” manner; reminder emails and popups give users a chance to think twice about an action that may put the organization at risk
Policies/Procedures — ensure that your policies and procedures are not just in place for reference, but are actually followed. Audit them periodically to verify compliance. If users are circumventing them, establish user task forces to optimize and improve them. This will also result in more user buy-in.

Parting Thoughts

Protecting against insider threats, malicious or inadvertent, can be the difference in success vs. failure for organizations with key legal considerations or intellectual property to protect. Developing the right approach to managing risk is more than just good business, it is a necessity. Owners and IT managers of organizations should identify their largest insider risks and develop “right-sized” approaches to mitigating them.