Cybersecurity Awareness Series: The Role of Awareness in Cybersecurity
One of the most basic needs when building or enhancing a cybersecurity plan is gaining awareness. Having a detailed awareness of where data exists, how and when it is handled, daily workflow of users, and where security gaps may lie will allow for proactive policy creation and remediation. Likewise, a lack of awareness and understanding of the environment will leave the door open for misplaced monitoring, vulnerabilities, and untracked data.
Cybersecurity Awareness Series: Is Cybersecurity Training Necessary and How Do I Know It’s Working?
No matter the size or industry, one of the most important, but also most overlooked areas of cybersecurity, is employee training. It's no secret that the vast majority of data breaches and incidents stem from human error. Many of these incidents are caused by otherwise well-meaning or trustworthy employees who were never fully trained on security risks related to the data they handle on a daily basis. However, even the best-trained employee can slip up, which is why training not only needs to take place but follow-up must be enforced with alerting and protections that ensure the security training communicated is actually being followed.
Cybersecurity Awareness Series: How Are My Endpoints Being Used?
The question of what truly occurs on your endpoints has been a topic of discussion for as long as computers have been integrated into the workplace. Over the years, various solutions have emerged, offering ways to inventory, conduct health checks, geo-track, and update endpoints within an organization. However, these solutions often overlook the day-to-day activities of users, such as machine usage patterns, specific applications accessed, modifications made, and the amount of time spent on the endpoints.
Cybersecurity Awareness Series: What and Where is My High-Risk Data?
While the question 'What is my data?' may appear straightforward, it can pose a significant challenge even to seasoned cybersecurity experts. Moreover, this fundamental yet complex question should always be among the first considerations when assessing your cybersecurity posture. Like a domino effect, gaining a more complete understanding of your data will naturally lead to insights on how best to safeguard it, ultimately providing an awareness of gaps in your risk profile.
The Pure Play vs Bolt-on Difference
If you haven't delved into the field of insider threat risks recently, now is the time to reevaluate your stance. While insider risk has been a longstanding concern, its notoriety has surged in recent years. This resurgence can be attributed, in no small part, to the shift towards remote and virtual workforces, which has increased the movement of data while simultaneously obscuring its visibility. The cybersecurity sector is undergoing a notable transformation, moving away from an exclusive emphasis on external threats. Astonishingly, more than 91% of internal breaches are traced back to human error rather than the handiwork of skilled hackers. Indeed, over three-quarters of companies now consider this to be one of their most pressing challenges in the current year.
This shift in focus has given rise to the term "insider risk," which has rapidly become a prevailing buzzword in the cybersecurity domain. Consequently, virtually every security solution available today is eager to tout its capabilities in addressing "insider risk." However, in many instances, these hastily integrated components are merely refurbished versions of existing Data Loss Prevention (DLP) or user activity monitoring tools. Regrettably, such adaptations often lack the robustness required to effectively tackle one of the most intricate challenges out there.
While traditional cybersecurity measures remain crucial, the rise of insider threats poses a unique challenge that demands specialized attention. Companies can no longer afford to treat insider risk as a mere component within a generic security solution. Instead, they must embrace dedicated insider risk detection software, like innerActiv, to fortify their defense against the growing threat of internal breaches.
Inside Out Versus Outside In View
From information leaks to stolen personal information, there is no doubt that insider attacks have become a serious cybersecurity concern. As with all cybersecurity practices, whether external or internal, it is critical to identify incidents before they occur rather than analyze events after the damage has been done. That’s why it’s important to not only implement solid perimeter protection for external intrusions, but also shield systems from internal threats.
While cyber threats continue to loom, organizations can take steps to create a defensive and, most importantly, offensive security posture. The approach of monitoring endpoint activity – at the user, device, and data level – can enable organizations to collect and correlate information about actions that indicate risky precursor behavior and in turn initiate an appropriate countermeasure.
Are you safe to do business with?
Each year, businesses conduct more of their operations virtually with an increasing number of digital products and services, making the interconnected supply chain more complex. Partners of your business are not just working with you, but with your network—and you with theirs.
With all the potential benefits, digital supply chains also present serious cyber security risks. Supply chains are vulnerable to cybercriminals who can steal a wide variety of information, interrupt production, and create more opportunities for damage in a computerized network—putting all parties at risk.
Because of this, more and more customers are expressing concern about cybersecurity (or the lack of it) in the digital ecosystem, and they are making business decisions based on those concerns. To stay competitive and secure, companies of all sizes need to better understand the expanding digital supply chain ecosystem and develop a strategy for monitoring it.
Employee Monitoring: A Balanced Approach
Monitoring employees for insider threats is a complex topic that involves balancing security concerns with individual privacy and ethical considerations. While it's important to protect a company's sensitive information and assets, it's equally important to respect the privacy and rights of employees.
It is no surprise that companies are exploring which technologies, processes, and programs they can adopt to proactively mitigate risk with a balanced approach.
Top High Risk Behaviors to Watch
An insider threat is a category of risk posed by those who have access to an organization's physical or digital assets. These insiders can be current employees, former employees, contractors, vendors, or business partners who all have -- or had -- authorized access to an organization's network and computer systems. For secure cyber defense against an insider threat, you have to keep an eye on anomalous behavioral and digital activity. With a baseline of data, risk scores for user behavior tied to specific events can be assigned and in turn deviations can be flagged and investigated.
One seemingly harmless move by a negligent contractor or malicious theft by a disgruntled employee can jeopardize a company’s data and IP. These situations can lead to financial or reputational damage as well as a loss of competitive edge.
Security leaders can start detecting insider threat indicators before damage occurs by implementing technology that analyzes employee, endpoint and data activity to proactively mitigate critical risk.
Customer Stories: Discovering Unknown Issues
New insider risk use cases are constantly emerging, highlighting the gaps in companies' cybersecurity postures when they fail to fully consider the endpoint and endpoint user's actions. Imagine your organization as a dark room. Each security tool used shines a flashlight into a different area - IAM, anti-virus, web filtering, email security, etc. This may illuminate more areas, but without visibility into the end user's actual endpoint activity, there will always be a dark corner hindering security.
Below are two excellent examples of cases where available cybersecurity and network-based security tools failed in exposing critical risks taking place in that dark corner of the room.
innerActiv Wins Global Infosec Award: Best Solution for Insider Threat
innerActiv is honored to have been recognized by Cyber Defense Magazine as the winner of the 11th Annual Global InfoSec Award as Best Solution for Insider Threat Detection announced at this week’s RSA Conference 2023.
Pentagon Leak Shines a Spotlight on Insider Threat
The recent headline featuring the leak of classified pentagon documents is this month’s high-profile example of the growing insider threat phenomenon that is occurring more regularly than most people realize both in the public domain as well as the private sector. With an arrest and investigations underway to determine the full scope and implications of the leak, it is shaping up to be one of the most damaging breaches in years.
In the aftermath, the situation also raises questions about the procedures the U.S. government has in place or is taking to protect sensitive information and ultimately safeguard national security. While many US agencies have improved their capabilities to detect anomalies in the movement of data, an insider risk management solution is the only way to truly analyze and predict evolving risk originating from inside actors – employees, partners, vendors with legitimate access to systems and sensitive data.
Getting Started: Insider Risk Management
Sometimes, the lack of knowledge can be the most serious security risk your organization faces. It is no longer a hidden fact, that insider misuse, either intentional of unintentional, constitutes grave consequence to organizations. Yet, insider threats are more difficult to identify and prevent than external attacks. They are often below the radar of conventional cybersecurity solutions such as firewalls, intrusion detection systems and anti-malware software. Because the insider already has valid authorization to data and systems, it’s difficult to distinguish between normal and harmful activity. For example, if an attacker logs in via an authorized user ID, password, IP address and device, they are unlikely to trigger any security alarms.
No matter the intent, the end result is compromised confidentiality, availability, and/or integrity of enterprise systems and data; and the value of sensitive data and information to organizations is higher than ever.
ChatGPT: A new insider threat use case
Since ChatGPT became available for public use last November, it’s presented questions for employers about use cases and how best to incorporate the tool into the workplace and maintain compliance. Confidentiality and data privacy are the primary concerns for employers because there is the possibility that employees will share proprietary, confidential, or trade secret information when having conversations with ChatGPT. Internal threats, whether on purpose or by accident, will also arise as a result.
Surreptitious Spyware versus Insider Risk Management
On Monday, President Biden signed an executive order limiting the purchase and use of commercial spyware by U.S. government departments and agencies. While the new order doesn’t entirely prohibit spyware, it lays out the criteria for which uses could be disqualified; and suggests that a case-by-case basis review will be required to allow agencies to acquire the technology for nonoperational uses, such as testing it for research or cybersecurity purposes.
This new executive order is part of an effort to improve cybersecurity and protect against malicious cyber activity. More specifically, it is to get ahead of the problem and set standards for other governments and its allies, which buy and deploy commercial spyware. It is also intended to ensure that government agencies are not engaging in activities that could be used to target and exploit vulnerable individuals or organizations.
Important to note, the directive targets spyware, not the array of cybersecurity tools commonly deployed within federal or local government or enterprise organizations for mitigating external or internal threats.
The Danger of Privileged Access and Users
Privileged accounts and privileged access are necessary to every business today. This role-based security model provides users with different levels of access that ensure an IT team can administer and manage the organization’s systems, infrastructure, and software, while also enabling employees to access the applications and data that allows them to perform business tasks.
While important to every organization, privileged accounts are also the most likely to be a threat and targeted by cyber criminals. This is because they allow the attackers to easily move around the network, accessing critical systems and sensitive data while remaining undetected and cleverly hiding their tracks.
Three Reasons Your DLP Strategy Needs to Evolve
For anyone who has worked in cybersecurity, the term “DLP” is a very familiar one. DLP, data loss prevention (or protection), became a must-have security tool decades ago and, since that time, has evolved into a blanket term covering all types of software. Everything from Identity Access Management (IAM) to time-tracking, EDR to CRM adds DLP to their list of features and benefits. It’s no surprise that many may also assume that the all-purpose “DLP software” can address their insider risk concerns. However, there are a number of weaknesses to bear in mind when considering DLP as a possible solution for insider risk and improving your overall security stance.
Bringing Hard Copy Security to RSAC 2022
As technology professionals, our data security focus tends to automatically fall on digital data. We have cloud repositories, data in motion, and newly created confidential information that all need our attention. It’s easy to forget that a major source of data loss is still the hard copy. Every day our carefully-protected digital assets are being...
The Threat Posed by the ex-Insider
Although the rate of employee layoffs has slowed since this time last year, the end is not yet in sight. With the ongoing ripple effect of 2020, many organizations are still grappling with the issue of having a significantly higher number of “ex-employees” than ever before. Still more are seeing this change coming in the...
innerActiv and Mandiant Insider Threat Services
68 was a big number in 2020 according to the 2020 Insider Threat Report: 68% of organizations report feeling moderately or extremely vulnerable to insider threat and 68% of organizations confirm that insider threats are becoming more frequent. However, just because the problem is recognized, does not make the solution simple. Many organizations struggle to...