The risks from within

Traditional cybersecurity is meant to create a fortress around your most important data. But what if the risk was coming from inside?

By WP BrandStudio

An employee turns in their resignation to HR, reason unknown. The next week, they come into the office late on a Friday evening, log into the network and download a dozen sensitive files from the system onto his personal USB drive. The files include highly sensitive plans for the company’s latest innovation.

What’s going on here? Perhaps the employee plans to leak the plans to a competitor. Or maybe they simply want to get a little work done over the weekend, and they’re unknowingly violating company security protocols out of expedience. Perhaps, upon further review, the company finds that the employee has been downloading and copying sensitive content to a USB drive for several months now.

There’s a reason that insider threats keep IT and security managers up at night. Traditional cybersecurity focuses on building a “castle and moat” around your most valued data. But what if the threat is already in the castle? And what if you’re not even sure what the threat is?

“To this day, the typical approach is to fortify the borders,” says Glenn Kaleta, principal engineering program manager at Microsoft. “If there’s a bad actor trying to gain access, you shut them down as quickly as you can. Insider threats are a little more complex. There are legal processes and cultural issues that can vary throughout an organization, especially if they operate in different geographies across the world. This is why many organizations are still somewhat immature when it comes to insider threats.”

Know the risks by knowing your people

The threat from insiders is very real: More than half of organizations have experienced insider risks in the last 12 months, according to a study by Crowd Research Partners. The costs are substantial, as companies suffer market, legal, reputational or productivity losses. The average cost of an insider incident arising from negligence is over $307,000, according to the Ponemon Institute. If the insider is malicious, it’s over $750,000.

The government-sponsored CERT National Insider Threat Center has compiled information on more than 1,500 insider incidents, and the anecdotes span the ordinary to the unusual. Insiders have sabotaged their employers’ computers, equipment and even their heating and air-conditioning systems; posed as tax preparers and collected $290,000 into their own accounts; and concealed $700 million in trading losses. Sometimes they’re recruited by foreign governments or organized crime to steal secrets or funds. And sometimes the incidents can be traced to simple negligence, such as when an employee clicks on a phishing link and lets an intruder in.

In its detailed framework for mitigating insider threats, the CERT center described a study that found insiders were less likely to attack when they felt a greater level of support from their organizations. CERT recommends that employers get ahead of this work to reduce employee stress and make employees feel valued through measures such as promoting work-life balance and implementing fair compensation policies.

Still, turbulence and dissatisfaction are inevitable at virtually every workplace, and so is the risk of insider incidents. In another CERT study of insider sabotage, 97 percent of attackers had experienced one or more stressful events prior to the incident. These included work-related events such as termination, poor performance evaluations or reprimands. In 87 percent of the cases, the insiders had performed technical precursors to the attack, such as unauthorized systems access or sending sensitive content outside of the organization.

And there are other, more nebulous, indicators to be aware of. In one study, University of Texas researcher Nicole Lang Beebe and her colleague Michele Maasberg found that subjects with certain personality traits were more likely to take advantage of a hacking opportunity if they experienced a threat to their ego (they were told they had failed a test). Beebe says organizations should train managers on how to help their employees handle negative work events, which she calls “trigger events,” without becoming disgruntled. “When people have these trigger events, you need to have good HR in place,” Beebe says. “People need to feel they’re being taken care of.”

Turn clues into action

Enterprises that want to control insider threats face a dilemma. “If you’re going to have a productive workplace, you need technologies that allow you to communicate and share information with agility,” says Talhah Mir, a principal program manager at Microsoft. “You have to trust your employees to have a dynamic, inclusive workplace. But with trust comes risk.”

Companies could lock down the workplace, but productivity will suffer. Workers may violate policies just to get work done—creating another form of insider risk. Another approach is careful review of employee activity. But even small organizations host gigabytes of data and a hive of activity. How do you sift through all that activity and information to narrow down on anything suspicious? And how do you do it without making employees feel scrutinized or oppressed?

Mir was part of an internal team that developed Microsoft’s own insider risk management system two years ago. After it was up and running, Mir and his colleague Raman Kalyan joined a meeting with Microsoft’s information security chief, Bret Arsenault, when they asked him: What keeps you up at night? “We had assumed it was going to be externally facing threats, but it was insiders,” said Kalyan, a director for product strategy at Microsoft. The conversation inspired the team to adapt the insider risk management system for Microsoft 365, which is now generally available.

The system brings together signals from many sources and then uses machine learning and analytics to efficiently find patterns that manual examination might miss. The system will learn of events like resignations—a typical precursor to an insider threat—from the company’s HR system, then connect that event to other potential suspicious activities like downloads of sensitive documents to a USB drive. The system understands if the files are sensitive through scanning content on the fly, looking for either sensitive information types or classification labels. It can combine this information with other potential precursors such as the use of offensive language or earlier security policy violations and put all these incidents on a timeline in an effort to help organizations make timeline and informed risk management decisions.

The system issues alerts based on risk indicators and assigns unusual activities with a risk score. If a case appears to be serious, the security team can send it through a workflow that could include colleagues in HR, legal or compliance. The display names for the risky insider can be made anonymous by default, to maintain the insider’s privacy and prevent bias during the investigation.

At Microsoft, the system has dramatically reduced the time the insider risk team spends looking for the anomalous behavior that might identify a risk, says Mir. Furthermore, with collaboration capabilities built in, the system drives great efficiencies into the investigation process that often spans organizational boundaries across security, HR, legal and the business.

Most employees understand that security measures protect the company and weed out bad actors, says Kalyan. They don’t object to a gentle reminder when they run afoul of security policies and expose their employer to risk. What’s more, better intelligence on the nature of insider risks ultimately helps the organization optimize its policies and training, while preserving a culture of trust and engagement. “Insider risk management really helps to support company culture,” Kalyan says.

Learn how to identify and take action on critical insider risks.

SOURCES:

• Crowd Research Partners
• Ponemon Institute
• Carnegie Mellon University (Software Engineering Institute)
• Microsoft