Insider threat detection

External attacks are not the only cyber security threats an organization has to consider when planning their cyber security strategy. While you are busy fighting against cyber security threats like spyware or ransomware, the biggest threat your organization could originate from within.

Insider threats pose a growing threat to security, with the number of incidents growing 44% over the past two years and the cost of these incidents have also increased.

To prevent data loss by insiders, you need to first understand who the insiders could be and identify where the insider threat is originating from.

What is an insider threat?

An insider threat is when someone with legitimate access to your network and has the potential to intentionally or unintentionally contribute towards harming your organization.

These insiders can be broadly classified into 3 types:

1. Malicious users: Individuals who are knowingly acting against their employer, including unsatisfied employees, people looking to harm the organization, double agents, and people who want to sell company data for personal gain.
2. Negligent/careless employees: Individuals who ignore security training and don't follow security best practices.
3. Compromised: Individuals who unknowingly pose a threat because they've been compromised through a scam, virus, or phishing attack, or have shared their credentials with the wrong person.

All three types of threats pose a danger to the organization and need to be detected and curbed before they can cause damage.

Importance of insider threat detection

Insider threats are hard to detect since they are caused by trusted individuals with access to sensitive company data. According to a global study spanning over a 12 month period, the cost of activities to resolve insider threats is $15.4 million. (Highest cost recorded in North America at $17.53 million). Remember, this is just a rough estimate and organizations have reported 100s of millions of dollars in losses due to fines, SLA breaches, and intangible losses like diminished brand value and customer loyalty.

Insider threats are difficult to detect because:

1. Insiders know your organization better than external threats. Remember, these are employees that have access to the intricacies of the organization and likely know how it screens insiders and can effectively counter those strategies.
2. Insiders can know the existing vulnerabilities in the organization's network and systems, allowing them to steal valuable data under the radar.
3. Most cyber security tools are designed to defend the organization against external threats and not from the threats within.

Insider threat indicators: Technical giveaways

Although insider threat indicators are often difficult to differentiate from regular work routines, there are few giveaways to finding insider threat activity. These include individuals who are:

• Downloading unusually large amount of data.
• Repeatedly trying to access restricted data.
• Sharing sensitive data with external accounts.
• Suddenly showing spikes in traffic and bandwidth consumption.
• Trying to access data that is irrelevant to their job description.

Defending against insiders

Curbing insider threats is not a one-time activity but a continuous process. Although it is difficult to eliminate insider threats, they can be minimized with the help of smart network security monitoring tools and by deploying employee best practices.

• Legacy network security monitoring tools are geared more towards protecting the organization from external threats. This calls for advanced network monitoring tools capable of detecting insider activity.
• Employees should be educated on the signs and consequences of insider threats by conducting routine classes on cyber security best practices.
• Implement a screening policy for new hires and ensure there's a process in place for revoking the access of exiting employees.
• Employ user access management (UAM) for in-depth access control.
• Regularly monitoring employees for unusual behavior, checking for both behavioral and digital indicators.
• Prevent data theft from privilege users by setting short expiry periods for privileged accesses.

ManageEngine Firewall Analyzer has been helping network security admins across the globe safeguard their organizations from threats. It boasts a wealth of features—such as employee internet usage monitoring, URL monitoring, change monitoring, and more—to aid in insider threat detection. Try Firewall Analyzer free for 30 days.

Featured links