Detecting Malicious Insiders Before Data Breaches Damage Your Business

Data breaches carried out by malicious insiders may be uncommon, but the damage they wreak can be catastrophic if detected too late. Enterprises need to take an active approach to dealing with the problem, which means understanding who the malicious insiders are, what drives them and how that should influence security policy.

As intriguing as the idea of a mysterious cyber-criminal hacking his way into a corporate network sounds, the majority of data breaches are the work of insiders.

An employee copies data to a USB device and leaves it in a cab; a contractor misplaces a CD with customer information-these are common causes of data breaches. But sometimes, it is not an accident, and rather than a master criminal scaling the network perimeter it's a sullen systems administrator causing the havoc.

Dawn Cappelli knows that well. As the technical lead of CERT's insider threat research at Carnegie Mellon's Software Engineering Institute, she has analyzed 450 cases of malicious insiders in search of common threads that businesses can use to develop security strategies. Activity by malicious insiders, she said, can be broken down into three categories: IT sabotage, theft of IP (intellectual property) and fraud.

"If you look at these crimes, you can't detect it with technology alone because a system administrator is going to use his authorized access to do what he does everyday and you can't tell if it's malicious or not unless you know when to look," Cappelli said. "Theft of IP; these people are going to take what they work on everyday. They are going to use their authorized access. Unless you put a strategy together that looks at the people, the process and the technology, it's going to be very hard to detect these things."

In the case of IT sabotage, these incidents are typically committed by someone such as a systems administrator who has privileged access, she said, adding that many of these crimes occur after the person has been terminated. The person will often create a back-door account-an act unlikely to raise red flags since it is not abnormal for administrators to create accounts-so as to be able to enter the network remotely later on. Detecting these types of situations relies on a mix of technology and people, starting with communication between human resources and IT when a disgruntled employee is about to be terminated and warrants closer attention.

"In all of these cases that we have of insider IT sabotage, we don't have a single case where people said, 'Oh, he was such a nice guy I can't believe he ever would have done anything like that,'" Cappelli said. "In all of these cases, it's the person who, they don't get along with people, they cause trouble at work ... and soon as you see somebody who's disgruntled you can't immediately say, 'Uh-oh, you know what, they might attack.' You're looking for this escalation where it gets worse and worse and they don't get over it like most people do."

Communication between human resources and IT can only go so far, of course. Technologies such as logging, activity monitoring and change management also have a key role to play.