The ‘insider’ is the dude in the office. He (or she) probably works in IT and looks and acts like a regular employee. They are however, probably a bigger risk to the organisations corporate information than a hacker on the public internet.
An insider is generally seen as a trusted user of the network. They have legitimate accounts and access on the corporate LAN to access, copy, modify and delete data without issue. So why are they are threat? We can define threat to be the potential exploitation of a vulnerability. The vulnerability in this case could be the trust, means and motive of an employee to perform a potentially malicious act against the organisations data and infrastructure. The motive and intent part is optional to an extent, as a malicious act may not necessarily be intentional, but could simply be erroneous or ignorance related. For example the opening of a malware link.
Intent
Intent is a complex issue to discuss. I think in the narrow sense they may be fewer individuals who will actively go and perform a malicious act against a corporate network. However they do exist. For example, the employee working on a notice period, disgruntled promotion hopefuls, an employee leaving to work for a competitor all may have some limited active motive to perform some sort of information discharge.
The intent though could be more subtle: Curiosity of a super user to browse data shares not relating to their line of work; The checking of pay or HR information because ‘they can’. Or for example, users who don’t want to follow desktop policy for things like screen savers, anti-virus or internet browser settings are all in a way creating a threat to the trusted network.
Identification
Managing, reducing or removing the threat of an insider attack can only be achieved if a correct understanding of the level and impact of the current threat has been completed. It’s important to be able to effectively identify ‘who has access to what’ within an organisation and correctly certify existing corporate LAN access levels. This first step is a common approach for many compliance initiatives such as Sarbanes Oxley, PCI-DSS and components of ISMS frameworks such as ISO 27001. Once existing access and users have been certified and any access misalignments and redundant accounts removed, it becomes easier to manage the remaining users and associated assets.
Data asset identification is also important here. Classifying data and assigning data owners is a well documented process and one that is often time consuming and ongoing. Understanding which data is critical and in turn which transactions access that data is an important step in creating a process to help protect the internal resources.
Mitigation
Mitigation, as opposed to complete remediation, is often the most effective response to insider threat. Managing the risk involved is often more cost effective than attempting to remove the risk entirely – it can often be the case of spending $1000 on a padlock for a $100 bike. Mitigation can be achieved in several ways.
- Based on the risk identification and access certification process, users should be assigned the ‘least privilege’ required to do their job
- Management of high privileged accounts is critical
- Implement regularly updated Separation of Duty policies across key systems
- Develop clear and well disseminated security policies and regular employee re-training
- Implementation of a Data Leak Prevention process with associated tooling
- Remove shared accounts and implement account-to-employee relationships to help drive auditing and accountability
- Implementation of a Security Information & Event Management solution for centralised management of system, network and application logs
- Use of abnormal access identification processes against the SIEM warehouse to help filter false positives and identify true access threats