Organizations Remain Vulnerable to Insider Attacks

Over the past few years, the security community has focused its attention on attacks coming from Odessa, Tehran, and Beijing. On balance this is a good thing as we are learning more about our cyber adversaries. That said, what about insider attacks? Back around 2008, insider attacks were viewed as the most dangerous of all since insiders tend to know what they want, where it is, and how to get it. Is this still the case? Yes. While APTs make the best headlines, it turns out that insider attacks are still a major problem. According to a recent ESG research survey of 707 organizations, 46% of firms believe they are “very vulnerable” or “vulnerable” to an insider attack. Yikes!Beyond being vulnerable to insider threats and attacks, the story gets even worse. It turns out that 54% of organizations claim that insider attacks are more difficult to detect and prevent than they were in 2011. Why? Several reasons:• 37% or respondents point to the fact that there are more people – like employees, contractors, and business partners – with access to the network. This increasing population makes it more difficult to isolate suspicious behavior.• 36% say that the growing use of cloud computing at their organization makes insider threat detection/prevention more difficult. Cloud computing distributes sensitive data access beyond internal IT and thus increases the attack surface for insider attacks. • 35% indicate that the growing volume of network activity makes insider attack detection/prevention more difficult. So network scale interferes with baselining normal behavior, pinpointing anomalies, and detecting/addressing attacks. • 27% admit that cyber-attacks like APTs make insider attack detection/prevention more difficult. This indicates that insiders are using sophisticated attack techniques that emulate “normal” behavior. If this ESG data doesn’t scare you then the name “Edward Snowden” should. While people debate whether Snowden is a hero or a traitor, there’s no question that he was able to circumvent tight security controls, steal sensitive data, and cause extensive damage to his employer (in this case, Booz Allen Hamilton and the NSA). Some people are paying attention to these alarming trends — ESG found that 45% of organizations admit that the Edward Snowden incident actually changed their perspective on insider threats. Given how vulnerable organizations are and how difficult it is to detect/prevent insider attacks, it’s time for all CISOs to reassess insider risks, defenses, and detection/prevention efficacy. If the ESG data is any indication, these areas may be much worse than they think.