The Enemy Within: Why Companies Should Maximise Internal IT Security
The ‘moat and castle’ model has been the primary basis for almost all security strategies up until now: a strong perimeter is established that divides the environment into a ‘trusted’ interior and a ‘distrusted’ exterior, with security focused on establishing the perimeter, enforcing access control and securing data as it comes in.
However, this way of thinking can create blind spots in IT security planning. A disproportionate amount of IT security spending is focused on protecting the perimeter from outside attack, when it’s also important to protect against insiders. In fact, twice as many cyber attacks originate from the inside than the outside. By virtue of their knowledge of the organization’s systems and databases, company employees will often pose a greater threat and be capable of greater harm than strangers to the company. However, with identity theft the number one growth crime worldwide and the skyrocketing value of personal data being held by organizations, the issue is starting to gain more visibility.
In an effort to better understand this problem, the US Secret Service National Threat Assessment Center (NTAC) and CERT examined the nature of insider attacks, who is causing them and why. The intent of the study was to identify if there was a specific profile that would fit an internal attacker, which could in turn help organizations to defend against them.
The Insider Threat Study (ITS) focused on the people who have internal access to information systems and have perpetrated harm using them. The study did not include incidents where the primary motivation was financial gain or theft of information or property.
Although the study found that most insiders who committed acts of sabotage were former technical employees, there was no identifiable demographic ‘profile’ of a malicious insider; they could be anyone. The attacks were almost always premeditated and the results were more than simply a nuisance. Most organizations involved identified financial losses, negative impacts to their business operations and damage to their reputations as a result of the attacks.
While most involved organizations identified financial losses and damage to their reputations resulting from the attacks, the study found that 75 per cent of the organizations experienced some form of impact on their business operations, including:
While the insiders tended to be technical people, most of the attacks were made using relatively unsophisticated methods exploiting systemic vulnerabilities. The trust implicit in the ‘trusted environment’ worked against the organization, making it easier for the attacker to complete their sabotage.
It is difficult to identify who within a company is likely to make such as attack, but one thing is very clear: IT managers need to understand that we all have a ‘blind spot’ when it comes to trusting ‘insiders’, and acknowledge that this is affecting the creation of IT security strategies, potentially leaving an organization exposed.