Q&A: Insider Threat

Bob Farber is the CEO of Symark. Prior to joining Symark, Mr. Farber was the Manager of Technical Support Operations for Candle Corporation. In this interview he discusses the growing problem of insider threat.

How has insider threat evolved in the past few years?
Insider threat has become more prevalent and sophisticated in recent years, thanks in large part to identity theft being such big business. According to the Identity Theft Resource Center (ITRC), as of April, 167 breaches were reported in U.S. so far in 2008, accounting for 8,391,871 exposed personal records. What’s more, according to the Computer Security Institute’s (CSI) 12th Annual Computer Crime and Survey from September 2007, insider threat was up by 17 percent. There is definitely a correlation between these figures:

Identity theft is often driven by international organized crime groups that solicit customer data and credit cardholder information via Internet chat rooms in exchange for large sums of money. These organized crime entities—which are beyond the reach of U.S. law—often contact “trusted” users within large organizations and ask them to access databases to obtain information that can be exploited. Ex-employees who are aware of lax security practices will “ping” accounts to see if they can still access or sell information about what an organization has—or has not—done to protect its vital data. Insiders have intimate details about the company’s efforts to protect proprietary systems and information, and they possess the skill set and knowledge required to exploit any existing gaps. All they need is a motive, which can be money, revenge or even just the chance to embarrass a current or former employer.

Two recent examples of insider threat (with very costly consequences) include the Société Générale fiasco and Tenet Healthcare incident. In January 2008, it was discovered that a Paris-based Société Générale trader committed fraud to the tune of $7.2 billion (with an additional loss of $50 million to cover forced short sale of assets). This trader previously held a position within the IT department and used the privileged access rights he was given in that role to create and conceal “dummy” accounts. In February 2008, a former Tenet Healthcare employee accessed the records of more than 37,000 patients and stole 90 identities before he was caught.

What are the main challenges of controlling access to proprietary systems?
Controlling access requires both a cultural and procedural change, as well as implementing the right technologies to restrict and monitor end-user and administrator access to applications, databases, files and systems. Most IT managers will agree that privileged accounts/access represent the greatest opportunity for fraud to occur in IT systems. However, many privileged users will ask, “Why can’t I have access to all those systems; I always have in the past?” This is precisely the attitude that must change.

Unfortunately, many IT departments are used to lax security (for example, no security measures for “super-user” accounts or using vendor-supplied default passwords because it is easier than setting up the alternatives processes and allocating budget). Many organizations do understand the importance of internal security, but just as many would rather not be bothered. If there were not compliance laws being enforced, many companies would likely choose to do nothing and take their chances. But good security breeds compliance, and things like logging activity and controlling access are important to deter fraud as much as they are for compliance (as well as “proof of innocence”).

We’ve heard about some extremely poor security measures that organizations have in place, including: Neglecting to define authentication and role-based access control requirements; neglecting to define security requirements/separation of duties for automated business processes which provides an easy method for insider attack; and neglecting to define requirements for automated data integrity checks, which allowed insiders to carry out their malicious activating knowing their actions would not be detected.

What critical problems can organizations face as a result of not mitigating insider threats?
For one, law suits. These can be very expensive and high-profile, severely damaging a company’s reputation and costing millions of dollars to reconcile. Also, insider threats lead to a significant loss of productivity and revenue through employee sabotage. This is especially true for smaller companies that may never be able to recover from a incident of insider threat.

A third potential problem is the threat to human life. For example, a former Cox Telecom employee recently plead guilty to information technology sabotage, having caused the loss of computer, telecommunications and emergency 911 services for thousands of Cox’s business and residential customers throughout Dallas, Las Vegas, New Orleans, and Baton Rouge, La. The guilty party faces a potential 10-year jail sentence and $250,000 fine, but the future is less certain for Cox. According to the company, services were fully restored and the damage repaired. However, the incident’s affect on Cox’s reputation has yet to be determined.

What type of complications can arise from orphaned accounts?
An orphaned account is an invitation to disaster. When the need for the account passes (i.e, when an employee leaves or is reassigned), that access to systems and data is no longer needed. This is when the account becomes orphaned. It is important to remove this access because it provides an entry point that no longer has a business purpose. Any access through this account is, by definition, a breakdown in the businesses’ protection of its valued data. The orphaned account also provides a more likely attack surface than a current user account, especially when the account becomes orphaned due to an involuntary departure of an employee. A terminated employee may harbor anger or animosity toward the company and their conduct is no longer constrained by fear of losing their job. We like to break orphaned accounts down into three categories: orphaned user accounts, orphaned privileged accounts and orphaned access.

Orphaned user accounts are what you would expect—the official user account that a person was given upon joining the company. These accounts are usually the easiest to manage as they are a known quantity. For example, when “John Smith” leaves a company, most IT organizations should have a straightforward process to remove his user account and any associated items (for example, all email accounts). However, a recent survey we sponsored revealed that many companies actually do not have an effective process to deal with orphaned user accounts. In fact, 61 percent of respondents said it took more than a couple of days to remove orphaned user accounts, and 12 percent said it took longer than one month. These figures are troubling when you consider that a recent Gartner report suggested “most attackers will do all they plan to do with a known password within only a few days,” so the disabling of orphaned user accounts needs to happen within a few hours after the employees departure to avoid exploitation.

Orphaned privileged accounts and orphaned access are trickier problems to solve. These issues generally revolve around people that are granted systems maintenance responsibilities at some point during their tenure with a company. Orphaned privileged accounts are highly-privileged accounts like a root shadow account that an administrator may create on a system simply to make various tasks a little easier. The main problem with these accounts is that they are created outside of the normal process, so if that person leaves or moves to a different role where that access is no longer required, there is no record of this account being created and it most likely will not be removed. Often, these accounts are given names that make them harder to detect. This also makes them harder to identify when the appropriate time comes to remove them.

Orphaned access is the relative of orphaned privileged accounts. This refers to access to common privileged accounts such as root, Oracle sys and Cisco enable in organizations that still share the passwords for these accounts. Unless a company is diligent in rotating all the passwords to privileged accounts every time an IT staffer leaves or when their role in the organization changes, a company is very susceptible to misuse of this privileged access. In our survey that I cited earlier, 62 of respondents stated they were still sharing privileged among their IT staff. This is a disaster waiting to happen.