Federal inside cyber threats should be attacked from all sides

Government IT administrators long have been trained to keep an eye out for the threats that come from outside their firewalls. But what if the greatest threats actually come from within?

According to a recent federal cybersecurity survey conducted by SolarWinds and Market Connections, that is a question that many Department of Defense and other government IT managers struggle to answer. In fact, the majority of the 200 respondents said they believe malicious insider threats are just as damaging as external threats. Further, one-third of respondents said they believe accidental insiders can be as dangerous as those who harbor malicious intent.

Welcome to the post-Edward Snowden and Bradley Manning world of federal IT, where an anonymous hacker can do just as much damage as a USB drive left carelessly on a desk. It’s an environment where technology, training and policies must be consistently deployed, and work together, to ensure lock-down security.

Technology is shifting

With the number of devices and users rapidly increasing, manual network monitoring is no longer feasible. As noted by survey respondents, ‘top tier’ tools to prevent internal and external threats pertain to identity and access management, intrusion prevention and detection and security incident and event management (or log management) .

Each solution offers continuous and automatic network monitoring, removing most of the day-to-day burden from IT managers. The tools alert administrators of anomalies, including breaches, data leaks, suspicious activity and unauthorized users and devices. Problems accurately can be traced to individual users and devices, helping identify the root cause of potential insider threats. Most important, administrators can address any potential issues far more quickly than ever before.

Ideally, tools should be easy to install and configure so they can deliver immediate value to any IT organization without extensive customization by outside consultants. However, tools also need to be supported with proper procedures and trained professionals who understand the importance of security and maintaining constant vigilance.

Don’t forget to train humans, too

Reflecting the importance of agency-wide training, 53 percent of respondents said careless and untrained insiders are the largest threat at federal agencies, while 35 percent stated “lack of IT training” is a key barrier to insider threat detection. IT personnel should be trained on technology protocols and the latest government security initiatives and policies, and receive frequent and in-depth information on agency-specific initiatives that could impact or change how security is handled throughout the organization.

All employees should be aware of the dangers and costs of accidental misuse of agency information or rogue devices. Forty-seven percent of survey respondents stated employee or contractor computers were the most at-risk sources for data loss, with 42 percent granting that designation to removable storage devices such as USB drives or CDs. Human error is often far more dangerous than explicit intent.

Policies should be carefully targeted

When it comes to accidental or careless insider threats, 56 percent of survey respondents were somewhat confident in their security policies, while only 31 percent were “very confident.”

Agency security policies, combined with federal policies serve as a security blueprint and are therefore extremely important. These policies include the Defense Information System Agency’s Security Technical Implementation Guides and the National Institute of Standards and Technology’s Federal Information Security Management Act Overall, policies should plainly outline the agency’s overall security approach and include specific details such as authorized users and use of acceptable devices.

Alarmingly, “security holes begin at the top…[senior managers] expect that they are protected and they are above any security holes—to the effect [that] they insist on admin rights to network resources,” one respondent said. Authorization for administrative users should not be based on rank—access should be limited only to those who absolutely need to get to specific data. The list should be small and continually monitored and adjusted. IT administrators should also maintain a list of authorized devices allowed to touch the network. This device ‘white list’ is critically important, especially as more devices begin to proliferate on the network, and bring-your-own-device remains a security challenge.

“Security is a challenge, and the enemy is increasingly sophisticated,” a respondent said. More and more, the enemy attacks from all fronts—externally and internally. Federal IT managers clearly need to be prepared to combat the threat using their own three-pronged defense of technology, training and policies.

Source: Content originally published on AFCEA.org

Content From