Can government agencies ever unmask the insider threat?

The recent arrest of Harold Martin, another National Security Agency contractor charged with allegedly stealing top secret computer code, is a reminder that the greatest cyber threats facing an organization often don’t come from a rogue nation -- they come from within.  

Despite significant increases in cybersecurity awareness, including the Presidential Executive Order 13587 -- which provides structural reforms to improve the security of classified networks and the responsible sharing of classified information --  there is no level of profiling that can predict insider threats with 100 percent effectiveness.

Nor is there a singular profile of an insider. This is why protecting against insider breaches requires a deep understanding of what --  and who -- the threat is.  Insider threat actors can be categorized into four primary groups:

Malicious Insiders. These are the real bad guys -- malicious, disgruntled employees who knowingly and purposely abuse their internal access to wreak havoc. They typically have the knowledge, access, information and desire needed to bypass existing security solutions to complete their task. Malicious insiders are often the most difficult to detect and the costliest to clean up after.

Unintentional insiders. Getting a laptop stolen or uploading the wrong file may seem innocuous, but these actions can unintentionally cause massive damage. A recent survey by the International Security Forum found that the vast majority of insider breaches are actually accidental. This is small solace in the aftermath of an incident.

Exploited insiders. External attackers commonly target high-value employees who have privileged access with spear phishing emails. On average, for every 10 phishing emails sent out, at least one employee will click on a link that infects his machine, giving attackers the foothold they need to execute an attack. Once attackers gain access to an endpoint, they target and steal privileged credentials, exploiting them to escalate access privileges and move laterally through the network until they reach and gain full domain-level access. This gives them full control over sensitive data and IT systems.

External insiders. More than 60 percent of organizations allow third-party vendors to remotely access their internal networks with the same privileges and access levels as internal employees. Despite this access, these users are not managed by the host organization, but by the contractor, making it incredibly difficult to secure their privileged access to IT resources.  Further, contractors are often targeted by external attackers, as in the hack at the Office of Personnel Management where a contractor was hacked and his privileged credentials were used to infiltrate the system.  

Protecting against the unmasked villain

Although insiders often have common motivations -- anger, financial gain and political beliefs to name a few  -- identifying and stopping these potential threats before they act requires more than profiling. It requires agencies to embrace and enforce basic, cybersecurity best practices that can unmask potential insider threats.

Reducing the insider risk requires a combination of training, awareness and an organizational commitment to enforcing best practices to limit risk. These policy decisions should leverage technology to automate their enforcement. People are fallible, but security shouldn’t be.

Here are five best practices that can immediately limit the harm from insider attacks – and even detect and  stop attacks outright before the damage is incurred:

1. Reduce the attack surface: Eliminate the exposure for a potential insider threat. This means restricting standard user privileges based on roles, which limits single-user access to critical network assets to prevent accidental damage and prevents attackers from taking over accounts with too many privileges. Controlling applications access also reduces the risk of a user being exploited by outside attackers.

2. Clean up credentials: Privileged credentials are the most powerful in any organization because of the broad access they provide. Attackers know this, which is why they seek to steal and exploit these credentials in almost every attack. Nevertheless, a recent survey found that businesses are still failing to employ best practices in securing and monitoring these accounts, with 40 percent of organizations saying they still store credentials in a Word document. Privileged credentials should be stored in a central repository, accessible only through strong control, multi-factor authentication, with full auditability. They should also be restricted to one-time use.

3. Limit the power to corrupt: We’ve all heard that power corrupts; absolute power corrupts absolutely. That saying may be a bit overwrought, but there is no reason for insiders to have more access than is needed for their jobs. Segregating administrative duties based on a privileged user’s specific roles limits accidental and intentional damage. Never grant full root access unless absolutely necessary.

4. Monitor and deter bad behavior: Profiling is never perfect, but don’t give up on it when trying to deter malicious behavior. Use technology to enforce and enhance monitoring by tracking and recording the individual use of privileged and shared accounts and aligning specific actions with specific people. This analysis lets IT managers see who is accessing information through anonymous accounts and take action as needed. Monitoring the activity of privileged accounts creates a baseline for employee behavior. The addition of privileged analytics allows an organization to immediately detect any anomalous behavior that may be an early indicator of malicious activity.

5. Look for the wolf in sheep’s clothing: Attackers steal privileged credentials because they provide the same access levels as an authorized insider. The activity of these accounts can look incredibly similar to that of legitimate users, but a closer look will reveal the attacker’s  “tells,” indicating that malicious activity is going on. Benchmarking what’s normal allows for the rapid detection of anomalies and in-process attacks.  

Defending against the insider threat requires more than weeding out bad actors and profiling who might be a threat. Preventing insider attacks requires smart policies and technology to automate and enforce those policies.

Multilayered defense against insider attacks can be adopted across all agencies, not just those making headlines.