Internal Cyber Threats #CybertSecurity
#Internalcyberthreats #SEOSecurity
#MobilSecurity #AITsecurity #MSSP #MicrosoftPartner #SilverSpringTech
When the topic of “cyber threats” is mentioned, the thought
of an individual wearing an oversized dark-colored hoodie, sunglasses, and a
smirk on their face crafting malicious packets with the ill intent to
compromise an organization’s server behind a laptop in a dimly lit cyber
cafe. Also, visions of the cyber threat
being executed from an individual or group outside of the company and from a
remote location.
According to the article “The Biggest Threat Cybersecurity
Threats are Inside Your Company” by Marc van Zadelhoff, that the threat and
attack images mentioned above account for less than half of the breaches out
there. So that leaves threats and attacks that are generated within an
organization by employees. Generated
threats and attacks internally can be a result of human error or
maliciousness intent from a disgruntled employee.
Any cyberattack, (internal, external, human error, or
malicious) implements a process called the Intrusion Kill Chain. The Intrusion Kill Chain consists of 7
phases. Each threat or attack implements
a few of these phases if not all 7 to successfully compromise a network. The statistics on internal cyberattacks are hovering over 50% is due to external attacks converting to internal attacks with the
combination of human error and disgruntled employees.
Human error consists of inadvertently
clicking into affected links, email attachments through spear phishing, or
downloading trojan horse affected keyloggers through using unauthorized
devices, thus allowing malicious activities to happen on a target network. The priority goal for external cybercriminals is to convert to an authorized user on the network as quickly as
possible to avoid detection. Once the
installation phase on the Intrusion Kill Chain is executed, with a backdoor on
a target’s network, the outsider has persistent access.
Disgruntle employees, according to a 2015 Cyber Security
Intelligence Index, constituted 31.5 percent of cyberattacks while human error
constituted 23.5 percent. Also, 59%
listed managers as one of the biggest insider threats in cybersecurity,
followed by contractors (48%), regular employees (46%), IT admin and staff
(41%) and 3rd party service providers (30%), according to a Dell study. On the Intrusion Kill Chain Phase chart, the
disgruntled employee would not have to implement certain phases depending on
the position and amount of access granted within the network system.
Statistics show that the average time to detect a compromise
or intrusion on a network is several months.
Between the actual intrusion to detection, severe damage such as
obtaining user names and passwords, selling of sensitive data, and exposing
propriety information to competitors.
These types of cyberattacks could cripple an organization for years if not
completely shut down an organization completely.
Listed below are some internal cyber threats and attacks
that organizations must successfully detect and mitigate:
1)
Unsecured Software: The first major internal security threat within the organization is not doing what needs to be done to optimize software security within the network. For example, hiring a staff of IT Developers
and then doubling the workload with network security duties as well. Simply put, these are two different IT
functions and specialties. There is not
enough time in a day to perform both functions, productively and efficiently, without exposing the company to vulnerabilities and threats.
2) Unsecured Devices: Another security vector within the promotion
of mobile-first, cloud-first computer networking environments for the convenience of
working from any device and from anywhere is detrimental to an organization’s
network. Having a lack of regulations on
apps and devices downloaded and used can exploit vulnerabilities. Examples of these breaches include:
- Downloading malware that gives cybercriminals control over the device
- Having cyber criminals spy on their WiFi
- Losing their devices, or having them stolen
- Failing to adhere to the company whitelist or technology use guidelines
Organizations need to weigh the pros
and cons of allowing employees to access the sensitive data over any device from
anywhere. Finally, providing proper
training to employees on accessing data while adhering to recommended IT security
guidelines and company policy.
3) Bad Access Practices: Setting security standards such as
implementing a strong password policy can mitigate risks but without any ill
intent people by nature are going to make things that are convenient for
them. The implementation of multi-factor
authentication will mitigate risks further from password authentication. This method acts as a safety net if the password was obtained by cybercriminals due to human error, for instance saving
passwords on an unencrypted document, or storing passwords on shared browsers
or public computers.
4) Email Accidents: “Reply All” can sink your company by sending a
sensitive message that is intended for one recipient but is received by
unintended recipients. This is a leak of
sensitive data that can have detrimental consequences to not only your company
but also to clients. This type of
mistake will make clients to do business elsewhere. There are tools that could enforce rules such
as, forcing encryption on
sensitive emails, stripping attachments sent outside the organization, warning
employees about emailing sensitive information, and forwarding copies of
certain emails to an admin, to prevent email
mistakes.
5)
Malicious Insiders: A constant internal threat will exist as long
as organizations have employees. Let’s
face it, employees will need access to information to perform the job duties
properly. So how can companies authorize
and restrict access at the same time?
There are various measures that can be taken, for example keeping
detailed logs to monitor and detect anomalies within the network. Implementation of this will detect anyone
downloading enormous amounts of information and/or an unusual amount of
transmissions outside of the organization.
Also, the logs will provide a source to the IT security team to
investigate the who, what, when, and where about the transmissions. Finally, action could be taken to prevent or
the continuous suspicious transmissions by shutting down the account until the
issue is resolved.
In conclusion, an effective security program will place
preventive and detective security controls on both the doors and windows of the
organization as well as on internal rooms and hallways. Don’t assume that every
user that is within an organization’s four corner walls is not malicious. Security must be made part of a company’s
culture no matter how loyal employees seem to be. All it takes is one time to cripple an
organization.
WE ARE DIGITAL TECHNOLOGIST PROMOTING
BUSINESS VALUE THROUGH DATA SUPPORTED SOLUTIONS.
Posts
