Welcome!

Industrial IoT Authors: Derek Weeks, Yeshim Deniz, Kevin Jackson, Elizabeth White, SmartBear Blog

Related Topics: Industrial IoT, @CloudExpo, Cloud Security

Industrial IoT: Blog Feed Post

Insider Security Threats By @Vormetric | @CloudExpo [#Cloud]

It would be fair to assume Edward Snowden might be one of the first names or faces to pop into your head

What We Talk About When We Talk About Insider Threats

What does the term “insider threat” mean to you? It would be fair to assume Edward Snowden might be one of the first names or faces to pop into your head. Snowden was an insider, and he proved to be a threat. He also had malicious intentions.

But, you would be shortsighted in thinking that malicious insiders are the biggest risk to your data. While Edward Snowden may be considered the “insider threat” poster child, not all employees have malicious intentions. In fact, it’s likely the vast majority of your employees have completely innocuous intentions (after all, most of us like our paychecks and want to keep them coming!) Counted among those employees, however, are your “privileged users.”

Here at Vormetric, we define privileged users as high-level computer operators who often have powerful, privileged access rights. They can include – but are not limited to – root users, domain administrators and system administrators.

More than just traditional insidersSimply by having access, privileged users may unwittingly put data at risk – or be used by an outside actor as a conduit for siphoning data. Unsurprisingly, privileged accounts are very attractive targets for attackers seeking to leverage access privileges for their own nefarious purposes. Therefore, it’s completely accurate to say that all privileged users – regardless of whether or not they have bad intentions – can be considered an “insider threat.”

Let’s take a look at a couple examples of high-profile data breaches and see where insider chips fell:

Sony Pictures

While there are still questions to be answered, CNN has reported hackers infiltrated the system by stealing the computer credentials of a Sony systems administrator. That’s right, a systems administrator. Although investigators have not ruled out the involvement of a malicious insider or former employee, they have not found evidence to indicate this was the case.

The ramifications for Sony from a financial, legal, and professional standpoint are unprecedented. Leaked information includes medical records, Social Security Numbers, birth dates, personal emails, home addresses, salaries, tax information, employee evaluations, disciplinary actions, criminal background checks, severance packages, and family medical histories.

Sony employees now suing the company for negligence have termed the hack an “epic nightmare.” This dramatic language is being echoed by Gartner cybersecurity analyst Avivah Litan, who believes the breach may very well be “the costliest ever for a U.S. company” and one that “went to the heart and core of Sony’s business.”

The attack also stirred unwanted memories for South Carolinians, which brings me to the next “insider” breach.

The South Carolina Department of Revenue

In October 2012, more than 3.3 million unencrypted bank accounts and 3.8 million tax returns were stolen in an attack against the South Carolina Department of Revenue. The attack started when a state employee responded to a phishing attack that enabled cyber criminals to use the employee’s (a privileged user) credentials, access the state’s databases, and steal sensitive data. While almost all of the credit and debit card numbers were encrypted, the social security numbers were not – leaving South Carolina citizens vulnerable to identity theft scams.

Did the employee intend for this to happen? No. Did the employee have access to a host of very critical, private data? Yes.

Where Do We Go From Here?

The breadth and depth of private and public sector breaches in the past few years further indicates there is a major disconnect when it comes to organization’s handling of data security – and how they treat insiders. Breach after breach we’ve seen insiders, or someone who has obtained insider privileges, wreak havoc.

Organizations that don’t properly control privileged user or system administrator access are setting themselves up for infiltration by malicious insiders or crafty outsiders looking to take advantage of the wealth of data at their disposal. Our 2013 Insider Threat data report found that only 27% of US organizations blocked privilege user access to sensitive data, whereas our 2014 European version of the report saw that number basically double. There is increased focus on the insider and their behavior within the organization, yet there is far too little emphasis on the data an insider can access with their privileged account access.

Here’s a hypothetical: an interviewee comes in with the desired experience and background a company is looking for, but they’re secretly hell-bent on eventually pulling a Snowden. Do you think it will be easy to identify them as a malicious insider during the vetting and hiring process? Smart agents aren’t going to give something away that would arouse suspicion; it’s pretty unlikely they will walk in brandishing, say, the North Korean flag or talking about their love of a Chinese competitor.

At the end of the day, once a malicious insider is in, he or she is in. What matters is the type of data said insider has access to.

This mantra also applies to non-malicious insiders. Like privileged user Susan up on the 9th floor. Susan, a systems administrator, is as loyal as they come. She feels passionate about her company, its ethos and her work. She’s smart, hardworking and would never intend to do something that would put company data in jeopardy.

While we can sing Susan’s praises all day long, it’s not her attitude that matters. It’s her access. It’s that she has the keys to her company’s kingdom, and if her company don’t have the proper precautions in place, there’s only so much she can do to hold onto them.

Compliance as a Crutch

“But, my company is up-to-date on compliance standards!” you say. Well, congratulations. You get to dodge government fines for at least another year. And by the way, so was Target.

If you really think being compliant means your data is safe, well, I have a bridge to sell you in China.

Since I’m on the subject of bridges, I’ll try to put this in terms that are easily understandable. Think of compliance as a bridge. It’s the bridge that allows your company to cross the water and enter into the castle. But, what’s protecting invaders from also crossing that bridge? That’s right, you need guards, and a moat, cannons, and maybe some dragons if you’re into that sort of thing.

My point is that compliance is not enough. It remains and will likely always remain a baseline standard for protecting information. But it should never be confused with security.

Oh, This Again: Encrypt Everything

If I sound like a broken record, it’s because this isn’t my first time at the rodeo. How many more of these breaches are we going to tolerate before we start to make changes to how we handle our data?

Back in October, I wrote a post about the strategy of “encrypting everything.” While I certainly won’t recap all of it, my opinion about the below adages remain the same:

  • Realize that your data is the target, not your network. Yes – attackers do penetrate firewalls and exploit application security holes, but they do so to get to high value data, just as an inside attacker would
  • Rein in your privileged users: if your employee doesn’t need access, they shouldn’t have it just because they have a certain title
  • Solutions exist that allow you to restrict access to sensitive information while still giving privileged users to the tools they need to perform their work, such as encryption with access controls linked to your identity management systems
  • While no company or CEO wants to discuss a data breach, having a broad-based “data first” protection strategy plays well from both a security and marketing perspective. It’s important to keep your fiscal and reputational house in order. If you need more assurances of this, I suggest you speak to a C-level executive at Sony, Target or Home Depot. While you’re at it, you might want to sit in on one of the many post-data-breach-government-oversight-committee-hearings on Capitol Hill. Pick your poison; you’ve probably got a few options.

Bottom line? With proper data controls, you can have your cake (sufficient use of privileged accounts) and eat it too (simultaneous protection of the data).

To close out, earlier I noted our 2013 Insider Threat report found that U.S. businesses were sorely lacking when it came to privileged user access restrictions. We’re excited to report we’ll soon be able to tell you if that statistic has changed in the past two years. But in the meantime, you’ll have to wait to just a little bit longer…

The post What We Talk About When We Talk About Insider Threats appeared first on Data Security Blog | Vormetric.

More Stories By Vormetric Blog

Vormetric (@Vormetric) is the industry leader in data security solutions that span physical, big data and cloud environments. Data is the new currency and Vormetric helps over 1400 customers, including 17 of the Fortune 30 and many of the world’s most security conscious government organizations, to meet compliance requirements and protect what matters — their sensitive data — from both internal and external threats. The company’s scalable Vormetric Data Security Platform protects any file, any database and any application’s data —anywhere it resides — with a high performance, market-leading data security platform that incorporates application transparent encryption, privileged user access controls, automation and security intelligence.

@ThingsExpo Stories
SYS-CON Events announced today that EnterpriseTech has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. EnterpriseTech is a professional resource for news and intelligence covering the migration of high-end technologies into the enterprise and business-IT industry, with a special focus on high-tech solutions in new product development, workload management, increased effi...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
SYS-CON Events announced today that SourceForge has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. SourceForge is the largest, most trusted destination for Open Source Software development, collaboration, discovery and download on the web serving over 32 million viewers, 150 million downloads and over 460,000 active development projects each and every month.
Multiple data types are pouring into IoT deployments. Data is coming in small packages as well as enormous files and data streams of many sizes. Widespread use of mobile devices adds to the total. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists looked at the tools and environments that are being put to use in IoT deployments, as well as the team skills a modern enterprise IT shop needs to keep things running, get a handle on all this data, and deliver...
We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA
SYS-CON Events announced today that IBM has been named “Diamond Sponsor” of SYS-CON's 21st Cloud Expo, which will take place on October 31 through November 2nd 2017 at the Santa Clara Convention Center in Santa Clara, California.
SYS-CON Events announced today that CHEETAH Training & Innovation will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CHEETAH Training & Innovation is a cloud consulting and IT training firm specializing in improving clients cloud strategies and infrastructures for medium to large companies.
SYS-CON Events announced today that TMC has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo and Big Data at Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Global buyers rely on TMC’s content-driven marketplaces to make purchase decisions and navigate markets. Learn how we can help you reach your marketing goals.
"MobiDev is a Ukraine-based software development company. We do mobile development, and we're specialists in that. But we do full stack software development for entrepreneurs, for emerging companies, and for enterprise ventures," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Conference Guru has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. A valuable conference experience generates new contacts, sales leads, potential strategic partners and potential investors; helps gather competitive intelligence and even provides inspiration for new products and services. Conference Guru works with conference organi...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
IoT solutions exploit operational data generated by Internet-connected smart “things” for the purpose of gaining operational insight and producing “better outcomes” (for example, create new business models, eliminate unscheduled maintenance, etc.). The explosive proliferation of IoT solutions will result in an exponential growth in the volume of IoT data, precipitating significant Information Governance issues: who owns the IoT data, what are the rights/duties of IoT solutions adopters towards t...
With the introduction of IoT and Smart Living in every aspect of our lives, one question has become relevant: What are the security implications? To answer this, first we have to look and explore the security models of the technologies that IoT is founded upon. In his session at @ThingsExpo, Nevi Kaja, a Research Engineer at Ford Motor Company, discussed some of the security challenges of the IoT infrastructure and related how these aspects impact Smart Living. The material was delivered interac...
No hype cycles or predictions of zillions of things here. IoT is big. You get it. You know your business and have great ideas for a business transformation strategy. What comes next? Time to make it happen. In his session at @ThingsExpo, Jay Mason, Associate Partner at M&S Consulting, presented a step-by-step plan to develop your technology implementation strategy. He discussed the evaluation of communication standards and IoT messaging protocols, data analytics considerations, edge-to-cloud tec...
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists examined how DevOps helps to meet the de...
When growing capacity and power in the data center, the architectural trade-offs between server scale-up vs. scale-out continue to be debated. Both approaches are valid: scale-out adds multiple, smaller servers running in a distributed computing model, while scale-up adds fewer, more powerful servers that are capable of running larger workloads. It’s worth noting that there are additional, unique advantages that scale-up architectures offer. One big advantage is large memory and compute capacity...
"When we talk about cloud without compromise what we're talking about is that when people think about 'I need the flexibility of the cloud' - it's the ability to create applications and run them in a cloud environment that's far more flexible,” explained Matthew Finnie, CTO of Interoute, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Datanami has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datanami is a communication channel dedicated to providing insight, analysis and up-to-the-minute information about emerging trends and solutions in Big Data. The publication sheds light on all cutting-edge technologies including networking, storage and applications, and thei...
SYS-CON Events announced today that Silicon India has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Published in Silicon Valley, Silicon India magazine is the premiere platform for CIOs to discuss their innovative enterprise solutions and allows IT vendors to learn about new solutions that can help grow their business.
The Internet giants are fully embracing AI. All the services they offer to their customers are aimed at drawing a map of the world with the data they get. The AIs from these companies are used to build disruptive approaches that cannot be used by established enterprises, which are threatened by these disruptions. However, most leaders underestimate the effect this will have on their businesses. In his session at 21st Cloud Expo, Rene Buest, Director Market Research & Technology Evangelism at Ara...