As the holidays rapidly approach, our halls are decked with images of Santa Claus. Kids are told stories of his workshop at the North Pole and how this beloved, trustworthy figure enters house to house, delivering everyone presents in a single night.
I know, it’s cheesy, but inviting Santa into your home without proper controls in place strikes me as the perfect example of an insider threat. Instead of gifting toys, he could steal them!
When I was a kid, I didn’t question the wisdom of inviting a person into my home based on reputation alone. As I’ve grown older (and possibly more cynical), things have changed. As a security professional, my philosophy is to give people the benefit of the doubt but to also put controls in place on the off-chance that someone takes advantage of implied trust.
One of the major precursors to an insider threat developing is a lack of visibility of employee behavior. In the context of 2020, there is also a potential for a rise in malicious insiders, with many companies furloughing , firing, or reducing the hours of their employees creating bad blood.
In this blog, we will explore notable insider threat events from this year, 4 insider threat types, and the controls organizations can implement to minimize risk.
Notable insider threat events in 2020:
Russian national arrested for attempts to recruit insider
In August 2020, the US Department of Justice (DOJ) filed charges against a Russian national who traveled to the US to recruit an insider at a Nevada-based company. The insider was told they would be paid approximately USD 1.35M in exchange for installing malware on their employer’s network.
The Russian national, Egor Igorevich, was reportedly part of a larger crime gang and intended to use the malware to gain access to the company’s network, steal sensitive documents, and then extort the victim company for a large ransom payment. To mask the insider’s activity and thus protect them from detection, Igorevich claimed his criminal gang would launch distributed denial of service (DDoS) attacks at the same time on the malware installation to distract the company’s security team. The plan was halted when the insider Igorevich attempted to recruit reported his activity to the FBI.
Shopify reported security incident caused by two support staff
In September 2020, e-commerce software company Shopify reported a security breach incident involving around 200 merchants’ data. Two members of the Shopify support team attempted to obtain customer transaction details from Shopify merchants, including details such as names, postal addresses, and order details.
Shopify stated the incident was not a result of a technical vulnerability in its platform, but due to rogue employees’ actions. The statement added that there is currently no indication that the data was used maliciously and that the company was working with the FBI in the US to address the incident.
Insider leaked University Hospital Limerick data on Twitter
In October 2020, a spokesperson for University Hospital Limerick reported that the medical facility suffered from a data breach. A third-party employee downloaded data from an automated system used to dispense medications,the employee then published the file online from a Twitter account. The file contained the data of 630 patients, 95 of whom were children, and included their full names, dates of birth, and medications used.
Four insider threat types to be aware of:
Alongside phishing and vulnerability exploitation, one of the most significant risks that organizations face is an insider threat.
Insider threats can range from unintentional misconfigurations or sloppy security practices to someone conducting catastrophic damage to crucial business systems with malicious intent and can generally be classified in one of the following categories:
- Inadvertent insider. This is where poor security hygiene lives. Misconfigurations and victims of social engineering are some of the most common types of security issues posed by this category.
- Malicious insider. These insiders abuse their access to have a negative impact on the availability, confidentiality, and integrity of an organization’s network, data, or intellectual property.
- Disgruntled employee. A trusted individual who justifies malicious activity as a response to a perceived grievance in the workplace.
- Negligent third-party. Vendors typically have some form of trusted access to an organization’s infrastructure. Potentially poor security practices on their end can lead to a supply chain attack, like the recently disclosed SolarWinds compromise.
Controls that organizations can implement to minimize risk:
Successful insider threat mitigation strategies should use controls that monitor and limit access to specific roles or job functions. The need to identify improper or potentially illegal actions by employees is paramount. A comprehensive risk assessment should include these policies and programs and play a role in incident response planning.
The Cybersecurity and Infrastructure Security Agency (CISA) provides some guidance on the creation of an insider threat mitigation program and outlines these key points:
- Start small and use the resources you already have at your disposal.
- Clearly define the program’s purpose and be ready to show it’s value with hypothetical damage caused by an insider threat scenario.
- Identify the critical data, infrastructure, or intellectual property that the organization values to evaluate the potential risk adequately.
- Develop a culture of shared responsibility that helps the individual. Psychologically speaking, content employees are less likely to act with malicious intent.
- Develop ways to report potential threats or incidents with confidentiality. These pathways should be easy to find and use by employees.
- Provide training for employees to recognize patterns and behavior that may indicate an insider threat.
While establishing an insider threat program can seem like a monumental undertaking, the value provided to an organization can be worth the long days of writing policy and procedure and compiling training.
In combination with other risk mitigation strategies, an insider threat program can further reduce the organization’s overall risk. When you let Santa come down a designated chimney and only have access to the room where he should leave presents, it’ll be a lot harder for him to get into any trouble or wreak havoc in your home.
Interested in reading more about the 2020 Cyber Threat Intelligence landscape? Read more on Optiv’s 2020 report here.