Insider Threat

May 16th, 2019

Cyber security threats that originate from within your own company are classified as Insider threats. These aren’t easily detectable as anyone with an authentic access to your network, can pose as a threat. They might be from the people whom we trust. It might be an existing employee or an ex-employee, a vendor, direct and indirect stakeholders with valid access.

These malicious insider threat can be again subdivided into three categories

  • Turncloak or malicious insider
  • Pawn or careless insider
  • Imposter or compromised insider

Indicators of Insider Attacks

How to identify breaches in the system?

The in house security team needs to understand the usual behavior to understand the anomalies and deviations. Use of machine learning can also be beneficial. Components like listing table access rights per app, specifying service account credentials and schema used and monitoring the usual data storage locations can be linked to alert mechanisms. Whatever said and done isn’t prevention better than cure?

One way by which you could anticipate such threats is by analyzing data history of all your users that would indicate the user behavior analytics and let you focus on the ones that need quick attention. Use of security risk management solutions for threat intelligence, anomaly detection and predictive alerts are also getting wide attention.

Secondly using key indicator monitoring on the user profiles integrated with active directory policies will also reduce the risk of abuse that comes along with access rights. Threat scoring can also be linked to user activity to get notified in the case of an attack.

Finally, along with the exit interview, employees also can be subject to auditing to ensure that any sort of company data isn’t taken along. Statistics reveal this type of data loss is becoming very common. To address this pain point, use of Privilege Access Management (PAM) solutions can help. One Identity, Systancia, CyberArk, Arcon & Thycotic are few of the PAM solutions that Mindfire offers. The sooner organizations realize the importance of implementing solutions for securing their data and organization from cyber threats and start seeing them as a part of long-term investments, the better it shall be for them as the threats are evolving constantly into more and more malicious versions.

Follow Us
Other Articles