Imagine yourself in a dining room in your company with colleagues and friends enjoying a meal. Suddenly, the lights flash and everyone’s belongings mysteriously disappear. The only suspects are those in the environment, including you. But how to find the culprit?
As much as the introduction of this text sounds a bit dramatic and the plot seems taken from an Agatha Christie book or a Sherlock Holmes tale, the feeling of having a threat within the company is very similar. An insider attack happens when least expected, while everyone involved in this compromised environment goes from innocent workers to suspects in a moment, and identifying the culprit is a challenging task.
Insider threats may be represented by careless or inexperienced employees, dissatisfied employees, third parties, partners, undercover spies, or any internal component that exploits or intends to exploit their legitimate access to assets to do something unauthorized.
According to a study by Verizon, 57% of information leaks involve insider threats and 15% of leaks are a consequence of the misuse of privileges.
As with detective cases, where a thief or a neighbor who does not live in the house is the primary suspect in crimes, many companies focus on threats outside the organization, such as cybercriminals and malware, while a dishonest employee may have been working among others for a long time without being identified, stealing information, and damaging business.
By having legitimate access and often unrestricted permission, these internal agents, malicious or not, can cause incidents within the organization without drawing attention, as they are somehow trusted by others while doing their job.
Disclosing confidential information, facilitating third-party access, and breaking equipment vital to a system are some of the incidents these bad employees may have.
In addition, careless professionals who do not know the company and its processes are also insider threats, as they can cause errors when deleting important information or downloading infected files, for example, just because they are not prepared.
We invite you to continue reading the text and learn what you need to do to protect your business from insider threats.
Who Are Considered Insider Threats?
Insider threats can come from employees and even partners or third parties who have access to your systems, as detailed below.
- Employees: They are above suspicion, are considered part of the organization, and are the last suspects.
- Service Providers: These people are underestimated and they can take advantage of their access.
- Partners and Third Parties: They are always under contracts and therefore receive access with high privileges, so the contract offers false protection to the company.
Former employees are also a threat. According to Deloitte, 59% of employees who leave a company voluntarily or involuntarily take data with them.
What Are the Main Motivations for Insider Threats?
In most cases, what motivates these internal malicious agents to cause an incident are financial and ideological issues, as well as the desire for recognition, loyalty to family, friends, or country, and even revenge.
Regardless of motivations, malicious internal agents seek to leak sensitive data and disrupt processes, as these are the events that can most damage an organization. This fact is clearly corroborated by cases reported in the media, such as:
- Edward Snowden Case: Snowden leaked nearly two million NSA files in 2013.
- Ricky Mitchell: After he found out he was going to be fired, he restarted EnerVest’s servers to factory settings and discontinued operations for a month.
- Zhangyi Liu: Chinese programmer working for Litton/PRC Inc. who accessed sensitive Air Force data. The contractor copied the credential passwords that were allowed to create, change, and delete any file on the network and posted them on the Internet.
- Christopher Grupe: After being fired from the Canadian Pacific Railway, he accessed the system again to delete files and change passwords, preventing administrators from authenticating.
- Paige Thompson: Former software engineer at Amazon Web Service, she accessed credit card information from more than 100 million Capital One customers. Amazon’s cloud environment configuration was not secure. Paige was aware of this incorrect configuration and abused her privileges to access data and share these methods in online chats.
Preventing an internal agent from stealing information can be more challenging than preventing an external agent from having access to assets, as internal agents have unrestricted access to endpoints and the network, and these are the components that correspond respectively to the means used to carry out attacks on an organization.
Other assets used to cause incidents internally are BYOD devices, which are increasingly accepted in companies today, even though their use is often uncontrolled.
Through these assets, attackers reach their real targets – databases and file servers -, as they keep the most valuable information for internal and external attackers, such as customer data, financial data, intellectual property, and privileged account data (credentials and passwords, for example).
This type of attack increases due to insufficient strategies or solutions to protect data, as well as a lack of training, employee expertise, and risk awareness at the administrative level of the organization.
What Are the Cyber Risks Associated with Insider Threats?
As we saw earlier, insider threats are not always exclusively from people who work directly for your organization. We can include consultants, outsourced contractors, suppliers, and anyone who has legitimate access to some of your resources.
To understand more about the subject, we have selected five possible scenarios in which insider threats may arise
- An employee or third party who performs inappropriate actions that are not intentionally malicious, they are just careless. Often, these people look for ways to do their jobs, but they misuse the assets, do not follow acceptable usage policies, and install unauthorized or dubious applications.
- A partner or third party that compromises security through negligence, misuse, or malicious access or use of an asset. For example, a system administrator may incorrectly configure a server or database, making it open to the public instead of private and with controlled access, inadvertently exposing confidential information.
- An agent bribed or requested by a third party to extract information and data. People under financial stress are often the main targets.
- A rejected or dissatisfied employee is motivated to bring down an organization from the inside, disrupting business and destroying or tampering with data.
- A person with legitimate privileged access to corporate assets, who seeks to exploit them for personal gain, usually stealing and redirecting information.
Whether the damage is caused intentionally or accidentally, the consequences of insider attacks are very real.
One of the ways to mitigate the risks of the scenarios above is to implement monitoring tools to track who accessed which files and alert administrators about unusual activities.
In addition to these actions, the management of privileged accounts also helps to reduce damage caused by insider threats and contributes to proactive cybersecurity behavior.
How to Reduce the Risks Associated with Insider Threats?
Any corporation is subject to some type of cyberattack, and it is essential to have a system that defends and maintains data integrity.
According to a report by Fortinet Threat Intelligence, Brazil has suffered more than 24 billion cyberattack attempts in 2019, a fact that reinforces the need to have efficient solutions against this type of threat.
Preventing external attacks is already very common within companies, and according to the Verizon Data Risk Report, 34% of data breaches involve internal agents and 17% of all confidential files were accessible to all employees, which turns on a big alert for companies to protect themselves from internal threats as well as external ones.
For this, it is recommended that some technology be implemented to efficiently monitor the privileged access of employees. To help you with this task, we have separated 5 practices on how to protect your company from insider threats, check them out:
1- Know Who Has Access to Privileged Accounts
One of the biggest mistakes of companies is making privileged credentials available to many users, which directly affects data breaches and the risk of leaks through internal threats.
You need to find out which people have access to protected environments, and ensure that people who do not need to access such environments have some kind of administrative credential, limiting the number of privileged users.
Ideally, credentials with a higher level of privilege should be controlled by those responsible for IT, so that there is no type of breach.
2- Ensure User Traceability
With the use of some technologies, you can know who, when, where, and what actions were taken by the user to perform a privileged session, in addition to limiting the actions that can be performed in the environment.
Some solutions alert and block the user who performs any improper action and provide session recording for analysis.
3- Third-Party Access
If any type of service provided to your company is outsourced, there must be some type of protection.
Ideally, any type of access to company environments should be monitored through a VPN dedicated to a specific application for a predetermined time.
The best way to ensure that there are no loopholes for internal threats in your company is by having a complete PAM password vault, which ensures protection from possible threats, monitors privileged sessions, and automates tasks.
4 – Password Culture
Even if it seems ineffective, implementing a strong password culture is a great way to avoid insider threats.
By memorizing a simple password, for example, a malicious employee can easily infiltrate privileged access and move around in environments that do not suit them, allowing possible attacks on the corporation.
In addition to protecting companies against insider threats, strong passwords also help to protect against external cyberattacks, therefore, ask your employees to use passwords with uppercase, lowercase letters, numbers, and symbols.
It is also important to change these passwords constantly, so that there are no future problems.
5 – Backups
Even using every possible way to reduce the company’s security breaches, it is essential to have a way to recover the data in case of any leak or access block.
A good option is automatic backups in critical and strategic systems, which allows the company to refuse to give in to any type of threat by the attacker.
6 – Extra Practice
Obviously, this type of attack is the most difficult to predict and prevent. These are malicious agents who may be working alongside you right now.
However, some measures can be taken to make it difficult for a new internal attack to occur:
- Checking Employee Background Before Hiring
- Applying Mandatory Vacation and Work Rotation.
- Monitoring Employee Behavior.
- Educating and Training Employees.
- Encouraging Employees to Report Abnormal Activities and Strange Behaviors of Their Colleagues if They Notice it.
Even With the Risk This Type of User Poses, They Are Necessary for the System. So, How to Control Them?
In another Haystax study, 60% of privileged IT users/administrators represent the greatest risk. They have large permissions within a system to execute infinite commands and view a large amount of information.
Privileged users are like stewards in suspense stories. They are the ones who have unrestricted access to various rooms in the house, perform important tasks, and are extremely trustworthy to members of the house, so it is no surprise when they are revealed as the guilty ones.
That is, privileged accounts are those with elevated access permission that allow account holders to access critical systems and perform administrative or privileged tasks. Like ordinary user accounts, privileged accounts also require a password to access systems and perform tasks.
Privileged accounts can be used by people or be non-human when used by applications or systems. The latter are also called service accounts. Privileged accounts, such as administrative accounts, are often used by system administrators to manage applications and hardware, such as network assets, and databases.
The problem with these accounts is that they are often shared, used on many systems, and can use weak or standard passwords, making it easier for insider agents to work.
Thus, when these accounts are not properly managed, they give insider agents the ability to access and download the organization’s most sensitive data, distribute malicious software, bypass existing security controls, and delete trails to hide their activities in audits.
One of the most secure ways to manage privileged accounts is through PAM (Privileged Access Management) solutions. This solution consists of cybersecurity strategies and technologies to exercise control over privileged access and permissions for users, accounts, processes, and systems in a corporate environment.
PAM As a Solution to Manage Insider Threats
As mentioned, privileged accounts represent high-value targets for insider agents.
Organizations need to adopt a Privileged Access Management (PAM) solution and also provide data on access to privileged accounts for this solution in their monitoring systems.
Privileged Access Management – or simply PAM – consists of the technology and processes that control privileged access, store all access records for auditing purposes and analyze the actions taken by users in real-time, generating alerts about unusual activities. Using this technology can make the identification and mitigation of insider attacks much faster and more efficient.
Therefore, we selected 7 resources present in the PAM solutions that are strategic for those companies that seek to reduce the possibilities of insider threats.
- Use of effective policies for all employees, whether remote, service providers, or third parties.
- Protection for the credentials of your most confidential assets (confidential applications, databases, privileged accounts, and other critical systems) in a central and secure repository.
- Limitation of privileged access to confidential information, such as customer data, personally identifiable information, trade secrets, intellectual property, and confidential financial data.
- Least privilege procedures and resources to provide employees with just the access they need. That is what we call a need to know.
- Limitation of local administrator rights for all employees’ workstations; and implementation of permission, restriction, and denial policies to block malicious applications.
- Implementation of workflows for the creation and governance of privileged accounts.
- Monitoring and recording of privileged access to confidential information, data, and systems.
The first steps to better protect yourself and your customers from insider threats consist of applying at least some privileged access management best practices.
Start by learning more about how the principle of least privilege works, then it is important to establish and apply the best password management practices and, finally, invest in a comprehensive PAM solution that has all these resources at your disposal.
Learn About the senhasegura Solution
Senhasegura is one of the largest PAM solutions in the world according to Gartner. In addition to preventing data leaks and abuse of privilege and avoiding internal threats, the solution is complete to guarantee protection against external threats.
The solution has granular access controls, credential management, detailed logging and session recording, and the ability to analyze user behavior. The senhasegura solution has several security locks that guarantee data protection from insider and external threats, such as logging, auditing, SSH key management, modules for secure DevOps, among others.
In addition, the implementation of senhasegura helps your organization to:
- Apply the Security aspect to your DevOps pipeline, ensuring DevSecOps.
- Carry out the proper management of digital certificates.
- Comply with LGPD and GDPR.
- Ensure security in your Cloud environment.
Request a demo now and discover hands-on the benefits of senhasegura to limit the damage caused by insider threats.
