How To Eliminate Insider Threats

Insider Cyber hack threats are a major security problem. For years, the primary security objective has been to protect the perimeter, the focus on keeping outsiders from gaining access and doing harm. But statistics prove that more risk exists within an organisation.

Indeed, many compliance regulations require monitoring of systems to identify and eliminate insider threat. According to Forrester, 58 percent of breaches are caused from internal incidents or with a business partner’s organisation.

And 55 percent of attacks are originated by an insider as cited in the 2015 IBM Cyber Security Intelligence Index.

Build a proactive Insider Threat Program

Key elements of the program should include: A cross-departmental team, including: HR, IT, CIS and Leadership.

Employee training on cyber-security policies and reinforcement of those policies. Real-time notifications at the point of violation should be a key component of the cybersecurity education program.

A user activity monitoring solution that will keep track of activities of privileged users, high-risk employees, remote vendors, anyone who has access to your systems and data. It should track and visualise users’ risk and behavior over time for faster and easier detection of insider threats.

Beware of Privilege Creep

Have clear video playback of exactly what happened before, during and after an event or alert. This decreases the mean time to resolve (MTTR) and provides organisations with irrefutable evidence that is vital to be able to take action.

Organisations typically have a good grasp of server statistics, access logs, performance, uptime, and system events. However, often gaps exist in identifying who has direct access to the server. Create credentialed logins (avoid using one general login), and employ an IT ticketing system to ensure all server-activity is very important.

Regularly Review Employee Access Controls

If there’s no need for an employee to access a particular account, revoke their permission. Additionally, consider restricting the use of remote login applications or cloud storage applications on corporate accounts.

Some organisations will perform this review yearly, but a more frequent review process (quarterly or monthly) can help mitigate insider threats.

Monitor all Data Exfiltration Points

With user activity monitoring and video playback, large print jobs from computers, USB data exfiltration, Cloud Drive uploads, sending data to personal email addresses, or sending files via Instant Messenger do not have to be investigated by combing through event logs.

With just the simple push of a playback button, the monitoring of these exfiltration points is so much easier and investigations can occur that much more quickly.

Know why Users are Installing/Uninstalling Software

Organisations use virtual desktops, non-persistent images, various software management tools, and account restrictions to control installed applications.

In most cases, these infrastructure-centric methods don’t provide information on user intent and underlying business need. Insider threat technology can eliminate these visibility gaps and allow organisations to know whether people are putting the organisation at risk.

Pay Extra Attention to High-Risk Users

Whether it’s through a conversation or the placement of a broadcast banner on a desktop, let high-risk users know they are being monitored. This will, in most cases, deter them from engaging in malicious activities.

Immediately change the password access to computers when an employee leaves. Additionally, make sure third-party services also know of this employee’s termination so they can de-authorise their account.

Ensure departing employees do not have company data on personal devices. Before a high-risk employee leaves the organisation, check whether they have company data on their personal computers, mobile phone, tablets, etc.

Speed Security Investigations

See the smoke before the fire. It is essential to be able to detect and respond to incidents and alerts quickly. Without the right security tools and programs, the mean time to detect to the MTTR can be weeks.

For example, the FBI often requests that companies not intervene with active exploits so they can gather evidence.
Integrate your user activity monitoring solution with other cyber security tools so you can provide irrefutable evidence and decrease MTTR.

Computerworld

50% of US Businesses Have No Formal BYOD Policy:

CIOs Are Neglecting Process & Most Efficient Options:

 

« Only 20% Of UK Banks Can Properly Detect Breaches
Could Britain Fight A Cyber War with Russia? »

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Cyber Security Service Supplier Directory

Cyber Security Service Supplier Directory

Free Access: Cyber Security Service Supplier Directory listing 5,000+ specialist service providers.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Sophos

Sophos

Sophos provides complete security solutions for protection against complex threats and data loss.

Malvern Cyber Security Cluster

Malvern Cyber Security Cluster

A group of more than 80 small cyber security companies. The Forum acts as a central point of contact for organisations who want to engage with small, innovative companies.

Redbud

Redbud

Redbud is a specialist search and recruitment firm for Information Security professionals.

CLUSIB

CLUSIB

CLUSIB is an association for the information security industry in Belgium.

Source Defense

Source Defense

Source Defense provides websites with the first ever prevention technology for attacks of third-party origin.

Threat X

Threat X

Threat X Intelligent Web Application Firewall (iWAF) utilizes a combination of application profiling and multiple sensor inputs to distinguish malicious attacks from legitimate user behavior.

Cask Government Services

Cask Government Services

Cask Government Services focuses on program management, cybersecurity, logistics, business analysis and engineering services for Federal, State and Local Government.

iQuila

iQuila

iQuila is a virtual overlay network which runs on top of an existing network. It creates a secure software enabled layer 2 connection across the internet or any public or private cloud.

Marlabs

Marlabs

Marlabs is a Digital Technology Solutions company that helps companies adopt digital transformation using a comprehensive framework including Digital Automation, Enterprise Analytics and Security.