Insider Threat: Focusing From The Inside Out

Many companies tend to concentrate their security resources on preventing external threats from penetrating their business and compromising assets. While threats posed by outsiders such as cybercriminals, hacktivists, state-sponsored actors, and terrorists are often perceived as the most urgent and critical, insider threats can be equally—if not more—damaging. This is why the most effective security programs not only acknowledge the legitimacy of the insider threat, they strive to proactively combat it as part of a broader risk management strategy.

What is Insider Threat?

According to US-CERT, an insider threat occurs when a current or former employee, contractor, or other business partner with authorized access to an organization’s network, systems, or data misuses it to negatively affect the confidentiality, integrity, or availability of the organization’s information or systems. These situations often entail the compromise or misuse of login credentials and-or the theft of intellectual or financial assets—all of which can lead to substantial ramifications for the company.

Despite the potential severity of the insider threat, many businesses operate under the common misconception that their employees are trustworthy and would never abuse their access. This mindset also ignores the unintentional insider threat where an accidental misuse of systems poses a similar risk.  For instance, if an employee’s computer becomes infected with malware following a spear-phishing attack or social engineering scam, the infection could compromise sensitive data to which the employee has access. This doesn’t mean that businesses should not trust their employees, but it does mean that password hygiene, user-access controls, bring-your-own-device, and acceptable-use policies should be stringent, continually enforced, and frequently updated as necessary across the company.

Insider Threat Programs and User Behavior

With an insider threat program, businesses can analyze a pattern of user behavior to proactively gauge if, when, and how the user’s actions could compromise business interests. Consequently, businesses without sufficient visibility into these behavior patterns may overlook small-yet-significant events that can indicate the early stages of an insider threat. For example, when a visit to a suspicious website or an email exposing sensitive data are viewed as innocent mistakes rather than potential indicators of an insider threat, companies may not address these behaviors appropriately. Insider threat programs are designed to identify and evaluate these issues and the extent to which they align with a user’s normal behavior patterns. This process can help businesses effectively identify and mitigate potential insider threats proactively.

Functional and Organizational Maturity

Before a company can build out its Insider threat capabilities, it must assess its functional and organizational maturity. Organizational maturity refers to the company’s ability to leverage threat intelligence based on its people and structure. Functional maturity refers to how well the company has implemented and executed on the goals of its security program.

Assessing a company’s organizational maturity starts with understanding the way its security programs protect its assets. The goal for most companies is for their security programs to transition to a more proactive approach where they are leveraging intelligence to anticipate potential threats and address overall business risk proactively. This entails using contextual intelligence to uncover emerging threats, learning how these threats operate, and determining the extent to which these threats could potentially impact the business.

After evaluating and benchmarking its organizational maturity, a company should assess its functional maturity to determine how well its teams are able to accomplish the objectives of its security program. Are teams responding to incidents as they appear, or are they investigating potential problems and proactively adjusting processes to mitigate risk? Companies also need to understand how they are leveraging intelligence and the sustainability and repeatability of existing processes.

Many companies don’t have the resources to create a robust insider threat program capable of anticipating threats preemptively, but assessing functional and organizational maturity can provide insight into whether a company is ready to take on these advanced goals.

The Best Place To Start

For companies that have yet to implement or fully develop an insider threat program, there are still basic steps that can help mitigate the risk. In particular, adjusting the employee off-boarding process can help companies become substantially less susceptible to insider threat. This process could include simple yet effective actions such as ensuring exiting employee accounts are closed, access privileges revoked, and login credentials invalidated in a timely manner. After all, if a former employee maintains valid access to company assets, any misuse would not trigger alerts. Given that many insider threat incidents have been linked to former employees, proper off-boarding can significantly lower these risks.

Another effective mitigation strategy is for companies to audit identity and access management (IAM) systems that manage users’ access to sensitive systems and information. Two common practices for organizations are an annual recertification process and a management approval process for employees receiving new entitlements. Incorporating layers of security into the protocol for granting access to users is fundamental in the defense against insider threat. Auditing this process often to ensure that all users have the appropriate amount of access and there is no potential misuse of privileges is key to mitigating the risks posed by insider threat.

More information on insider threat is available in the webinar, “Insider Threat: Focusing From The Inside Out,” which was recorded on January 24, 2018. Download it here.

This blog post was written in collaboration with Flashpoint Global Channel Partner ThreatQuotient.