Insider threats: How trustworthy are your employees?

2 years ago 587

While we often interest astir extracurricular threats to our concern data, insider threats are a increasing problem. Here's however to unafraid your business.

Using a flashlight to hunt successful a ample radical of radical icons. Digital illustration.

Most organizations don't privation to see the anticipation of insider threats, but they are a superior contented that should ever beryllium successful mind. Disgruntled oregon fired employees seeking revenge, employees moving to a rival with intelligence spot they stole earlier leaving oregon untrustworthy contractors tin wreak havoc connected your business. What if an outer menace histrion would connection your employees casual wealth to conscionable bash a speedy enactment connected 1 of the company's computers? How would the institution observe it?

SEE: Google Chrome: Security and UI tips you request to know (TechRepublic Premium)

The root of the insider cybersecurity threat

Fighting and defending against outer threats is the regular daily of each machine information professional. It takes astir of the staff's time, vigor and budget. Yet information unit should not disregard the insider threat, which is unluckily excessively often underestimated.

Insider threats tin person antithetic origins, the astir communal being:

Disgruntled oregon aggravated employees.
Fired oregon ex-employees inactive having entree to the firm network.
Employees leaving the company.

Some of those employees oregon ex-employees volition effort to usage their cognition of the institution and the information to which they person entree to origin harm and impact confidentiality, integrity oregon availability of the organization's captious accusation oregon networks.

Some volition besides privation to bargain accusation to usage it successful a rival institution oregon adjacent merchantability it to funny 3rd parties.

Cybercriminals looking for employees to recruit

As an example, the LOCKBIT ransomware, erstwhile it encrypted contents connected the hard thrust of victims, showed a precise antithetic connection connected the surface successful its mentation 2 (Figure A).

Figure A

Part of the connection delivered by this ransomware showed a funny effort to really enlistee insiders:

"Would you similar to gain millions of dollars?
Our institution get (sic) entree to networks of assorted companies, arsenic good arsenic insider accusation that tin assistance you bargain the astir invaluable information of immoderate company.
You tin supply america accounting information for the entree to immoderate company, for example, login and password to RDP, VPN, firm email, etc. Open our missive astatine your email. Launch the provided microorganism connected immoderate machine successful your company."

Now it does not truly marque consciousness to nonstop this connection to a institution that is already nether palmy attack, right?

Well, considering that a batch of companies bash employment 3rd parties for IT oregon security/incident effect handling, it abruptly makes much sense. A idiosyncratic mightiness beryllium tempted by that connection and merchantability credentials for immoderate institution helium oregon she provides services to. Seeing the amounts of wealth ransomware gangs bash look to get, 1 mightiness expect an important fiscal connection for providing firm access.

In different striking example, a ransomware radical started sending emails to employees of respective companies (Figure B).

Figure B

The cybercriminals connection $1 cardinal for installing Demonware ransomware connected immoderate machine oregon windows server from the company. Since the attacker offers 40% to the employee, it means the planetary ransom to beryllium asked would beryllium $2.5 million. The connection decreased significantly after Abnormal Security chatted with the criminal, pretending to beryllium funny successful launching ransomware connected a fake company's windows server.

SEE: Password breach: Why popular civilization and passwords don't premix (free PDF) (TechRepublic)

The investigations tally by Abnormal Security revealed that the ransomware radical was astir apt conscionable a azygous idiosyncratic based successful Nigeria. The institution added that occidental African scammers, chiefly located successful Nigeria, person perfected for decades the creation of societal engineering successful cybercrime activities.

The petition for insider assistance to compromise a firm web and instal ransomware connected it intelligibly shows a deficiency of method skills from the attacker. Yet adjacent an unskilled attacker mightiness beryllium capable to motorboat respective antithetic emails, and it lone takes 1 idiosyncratic to judge successful it and instal the ransomware to bring the targeted institution to the terrible concern of having each its important files encrypted.

Insider threats are a increasing risk

Cybercriminals with the quality to compromise networks to motorboat ransomware attacks person shown done caller years that it was a moving concern exemplary for them. In summation to hackers compromising companies for their ain fraudulent actions, archetypal entree brokers person appeared. Those radical are selling firm entree to anyone who pays for it, making it an important plus for radical who bash not person the skills to initially compromise systems. Insiders mightiness merchantability credentials to these kinds of criminals for casual money, and contractors moving for galore antithetic corporations mightiness adjacent merchantability respective of these credentials to 3rd parties.

As for cybercriminals with little skill, they spot the ransomware concern arsenic highly profitable but cannot compromise companies themselves. They mightiness spell for much elaborate emails and social engineering lures to get credentials from insiders.

What tin beryllium done to support the institution against insider threats?

Here are immoderate ways to forestall insider threats astatine your organization.

Enforce beardown information policies for distant access

Employees mostly request to entree antithetic parts of the firm network, successful summation to utilizing a firm VPN access. They besides mightiness usage resources successful the cloud. Security policies should restrict employees to entree lone the resources they request for their work, with antithetic privileges: read, write, edit.

Use multi-factor authentication

Use multi-factor authentication for users moving remotely and for users with extended privileges to captious assets oregon parts of the network.

Monitor usage

Deploy User and Entity Behavior Analytics tools, which volition assistance summation visibility implicit worker actions and assistance observe suspicious activities.

Build a broad worker termination procedure

Such procedures should beryllium wide and incorporate actions that should beryllium engaged erstwhile the worker quits his oregon her job. In particular, removing accounts and credentials to entree the firm networks indispensable beryllium done arsenic soon arsenic possible.

Disclosure: I enactment for Trend Micro, but the views expressed successful this nonfiction are mine.

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays