Enterprises are missing the warning signs of insider threats

Organizations struggle to identify the warning signs of insider threats, according to a report by the Ponemon Institute.

The report surveyed a global pool of 1,249 IT and IT security practitioners and found that 53% of companies find it impossible or very difficult to prevent an insider attack when data is being aggregated, a key indicator of intent of an attack.

“The vast majority of security threats follow a pattern or sequence of activity leading up to an attack, and insider threats are no exception,” said Dr. Larry Ponemon, Chairman and Founder, Ponemon Institute.

“Many security professionals are already familiar with Lockheed Martin’s Cyber Kill Chain and the MITRE ATT&CK framework, both of which describe the various stages of an attack and the tactics utilized by an external adversary. Since human behavior is more nuanced than machine behavior however, insider attacks follow a slightly different path and, therefore, require modern approaches to combat.”

The five steps nearly all insider attacks

Over the course of thousands of insider threat investigations and incidents, analysts have identified the insider equivalent of these frameworks: the insider threat kill chain, which encompasses the five steps present in nearly all insider attacks: Reconnaissance, Circumvention, Aggregation, Obfuscation and Exfiltration.

To fully understand an insider incident, visibility into the entire kill chain — not just one or two steps — is imperative. In fact, the earlier phases of the kill chain hold the answers to some of the most important questions – both for incidents that have yet to fully unfold and for those that have already occurred.

The findings of this report reveal that enterprises are missing the warning signs of insider threats and the intent of perpetrators.

Missing the indicators of insider threats

• Nearly half of companies find it impossible or very difficult to prevent an insider attack at the earliest stages of the insider threat kill chain
• Only 32% of companies say their organizations are very or highly effective in preventing the leakage of sensitive information
• 15% of organizations state that no one has ultimate authority and responsibility for controlling and mitigating workforce risks

“Our findings indicate that in order to fully understand any insider incident, visibility into the nuance and sequence of human behavior is pivotal,” said Rajan Koo, Chief Customer Officer, DTEX Systems.

“Often times, organizations don’t know that an attack has occurred up until (or after) step five of the kill chain – exfiltration – occurs. However, if businesses fill the gaps identified within this report with the right behavioral intelligence control and designate a clear authority for controlling and mitigating this risk, these threats can be detected and deterred during an earlier stage of the kill chain much before any real damage is done.”