Insider threat and privileged user abuse

Despite heightened awareness of insider threats, most organizations continue to grapple with how to mitigate risks to their networks and sensitive information.

According to a new report by Raytheon Company, people with access to privileged data – such as health care records, sensitive company information, intellectual property or personal records – frequently put their organization’s sensitive information at risk.

Focusing on ‘the human factor,’ the survey report, “Privileged User Abuse & The Insider Threat”, finds that many individuals with the highest levels of network access in organizations are often granted access to data and areas of the network not necessary for their roles and responsibilities. The report reveals that 65% of survey respondents indicated that curiosity – not job necessity – drives these same individuals to access sensitive or confidential data.

“The results of this survey should serve as a wakeup call to every executive with responsibility for protecting company or customer sensitive data,” said Jack Harrington, vice president of Cybersecurity and Special Missions, Raytheon Intelligence Information and Services. “While the problem is acutely understood, the solutions are not.”

Conducted by information security industry leader Ponemon, the comprehensive survey identified 693 respondents as “privileged users” meaning they are network engineers, database administrators, information-security practitioners and cloud custodians.

Key findings include:

• Eighty-eight percent recognize insider threats as a cause for alarm but have difficulty identifying specific threatening actions by insiders.
• Sixty-nine percent surveyed stated their security tools don’t provide enough contextual information to determine intent behind reported incidents and 59 percent stated their tools yield too many false positives.
• Forty-seven percent surveyed said it would be likely that malicious insiders would use social engineering or other measures to obtain someone’s access rights – this is up from 21 percent from a 2011 survey.
• Forty-five percent say it is likely social engineers from outside the organization will target privileged users to obtain their access rights.

What is most at risk:

• While 59 percent believe general business information is at risk, 49 percent say customer information is most at risk due to a lack of access controls over privileged users.
• Fifty-seven percent believe background checks are lacking in most organizations before issuance of privileged credentials.
• Budget – while 88 percent of those surveyed recognize enhanced security as a top priority, less than half this number (40 percent) have a dedicated budget to invest in enabling technologies to reduce insider threat. Most use existing cybersecurity tools not necessarily designed to combat insider threat; 72 percent stated they use authentication and identity management tools to manage privileged user abuse.

“The goal of this survey is to not only share current insider threat statistics but to educate organizations on their privileged users and the threats and attacks that can happen because of the access they own,” said Harrington. “If a privileged user wants to do bad things, their elevated access to the company network makes it easier for them.”