Evolution of Internal Fraud Threats

The Evolution of Threat Management Strategies

In the past, organisations have focused their security efforts on stopping external threats by deploying an array of security solutions, including firewalls, IDSs/IPSs, antivirus software, DoS prevention systems, secure router configurations, and vulnerability scanners. Centralised security solutions evolved when network managers were becoming overwhelmed with volumes of diverse event data generated by these solutions. These solutions allowed organisations to process the vast number of data sources, and records and give a view of external threats that they were facing. This often included correlating events across multiple sources. However despite the massive perimeter investment to secure the edge of the enterprise, the rate of security breaches rose by 32% when Q1 & 2 of 2006 was compared with the same quarters in 2007.¹

In part, despite the huge investment made in these security technologies, data leakage and inappropriate user activity from inside the enterprise has become a much more complex challenge, forcing organisations to reconsider their approach to managing risk from the inside.

Furthermore with the evolution of compliance many organisations not only must secure from leakage, but must be able to prove that they are keeping sensitive/high value data secure, and away from employees who do not need to view that data, and be able to demonstrate the integrity of the reported information. The best example of data privacy is HIPAA (security of personal health records in the US), which defines how people’s health records must be kept private in all forms (computer or paper).

The Growing Problem of Inside Threats

Inside threats are the most difficult security threats to resolve. Why? Because identifying the motives of those behind interior threats present particular challenges to security organisations as defining legitimate/illegitimate access is very difficult to define by employee. Individuals sometimes deliberately try to access proprietary data, while others inadvertently access and even unintentionally distribute sensitive information. Additionally, given the sheer volume of internal data transactions, prioritising the real threats without an automated solution is virtually impossible. However the fraudsters have already identified a path of least resistance, which is to access the data directly at the database using an employee or their access method. Given that most databases in the enterprise do not have meaningful security turned on, data level access is unmonitored and difficult to trace.

In Search of Meaningful Security Data

Organisations are required to capture, monitor, and audit an overwhelming amount of data in order to effectively manage risk and maintain regulatory compliance. Database tracking programs typically collect all activities into transaction logs without applying filters, leaving a massive data repository to manually review. Yet even when companies take the initiative to manually turn on, on database logging, to attempt to analyse logs and user activity, they typically fall short due to the volumes of events and the resulting lack of timely, comprehensive reporting, not to mention the significant impact on database performance, or the resultant cost of qualifying such changes with very scarce resources. Ultimately, they find it impossible to accurately and cost-effectively identify and mitigate insider threats at this layer.

Managing Perimeter and Insider Threats: A Unified Defense Strategy

An effective data intrusion detection solution gives organisations a formidable defence strategy that even the most determined, malicious threats cannot outsmart. It provides organisations with accessibility to contextual information and offers insight on real-time access to the data whatever access method is used. The bi-product of the access analysis should be a comprehensive log that can be analysed for trends via a flexible reporting system. With such rich data being fed into the reporting database, reporting on compliance such as PCI, Sarbanes-Oxley or HIPAA becomes straightforward. The objective of any organisation when faced with compliance should be to generate the business value that compliance is designed to give – enhanced data security and integrity, not just tick a box and generate a significant cost to the organisation.

With the right solution, organisations can demonstrate the effectiveness of controls on compliance-related data. Additionally, they can proactively monitor user activity of applications and databases – rather than exhausting resources on the impossible task of trying to manually review data logs, which at best results in reacting to security incidents well after the fact. Companies can also implement a standard, repeatable, and auditable incident resolution workflow that manages log data in real time.

10 Strategies for Combating Inside Attacks

To effectively safeguard data and ensure compliance, organisations need to identify and remediate threats from outside and inside the organisation. Today’s proven technology can effectively meet this security challenge, as long as the solution is equipped for battle and able to implement the following 10 strategies for combating inside attacks on a database:

1. Monitor internal activity and identify internal threats. Ensure data security by monitoring all access paths to sensitive corporate and customer data.
2. Perform inside threat and penetration forensics. Obtain continuous, real-time logging of all SQL and HTTP activity and monitor logins, logouts, failed login attempts as well as unauthorised access.
3. Be able to rapidly identify suspicious activities and recurring patterns of malicious activity. Identify activities such as questionable access to databases, devices, or applications, attempts to alter or delete database files, and installation of malicious software.
4. Obtain real-time, actionable information on inside threats. Track all requests and response activities of users and applications, capture login and other activity metrics, and provide policy-driven alerts.
5. Ensure relevant regulatory controls are in place and that the system is collecting the appropriate data needed for audits. Address regulatory compliance and audit requirements that require database and user activity monitoring to demonstrate controls and document specific activities.
6. Monitor database activity without impacting system performance. Employ a solution that can monitor database activity from a dedicated network appliance so that detailed traffic analysis and entire user sessions can be captured without any performance impact.
7. Obtain comprehensive reporting on security posture and suspicious activity. A comprehensive reporting solution can provide the entire security organisation with timely, relevant information on insider risk levels and overall security posture.
8. Allow visibility into risk levels and activities. Utilise a product that features inside threat dashboards to allow all security stakeholders to easily track inside risk levels and activity, and assess the impact of insider incidents on business continuity.
9. Implement a customisable alerting strategy that ensures the right people have the information they need. Establish an alerting program that uses multiple alerting mechanisms.
10. Employ a cost-effective, low risk to deploy, manageable security solution. Reduce the cost of risk management and compliance by utilising predefined rules and reports, privacy-friendly logging features, and encrypted, time-stamped files.

A multi-layered, yet centralised, approach is critical to ensure that all activities that touch important data at the core of the organisation are monitored. With the right data layer solution and OS monitoring, organisations are empowered with the critical centralised command and control needed for optimal security, which moves well beyond simply identifying which threats have occurred. Companies can become proactively involved during an access incident, and take appropriate actions to stop the breach before it becomes a data leak or worse.

Conclusion

As the value of data increases, and data fraud evolves, protecting the information stored on your database is becoming increasingly critical. Since organisations have so many access points and even insiders can’t be trusted, protecting the data is more difficult then ever. Therefore, organisations need to find a solution that can identify and differentiate erroneous access from legitimate access and initiate the appropriate action before the access causes wide damage to the organisation. This solution also needs to not be on the same platform as the database in order to avoid performance impact to the database. Organisations need to look at network-based database monitoring tools to get a simple to implement but highly effective solution to protect their data.

References

Calculating the Cost of a Security Breach, by Khalid Kark, Forrester Research. 10 April 2007.
Enterprises and Employees: The Growth of Distrust, by Richard Hunter, Gartner, Inc. 11 February 2005.