This month we were a sponsor and exhibitor at the Gartner Security and Risk Management (SRM) Summit. As always, it was a great opportunity to meet with leading cybersecurity experts and discuss the challenges they face in the daily battle against ever more sophisticated cyberattacks. It was also a chance to hear from Gartner analysts themselves on their perspectives of trending cybersecurity issues and where the industry is headed.
Gartner analyst Jonathan Care had a session on, “Building Incident Response Scenarios for Insider Threats”. He delved into how complex of a problem the insider threat really is. Presenting with fellow analyst Brian Reed, Mr. Care described how there is no universal type of insider threat. Instead, there are many different insider threat personas. And each of them presents unique challenges to those charged with finding and stopping them.
“There are many types of insider threats – disgruntled employees, determined saboteurs, good-natured bozos…”
– Jonathan Care, Senior Director, Gartner
What’s the Scope of the Insider Threat Problem?
According to Verizon’s 2019 Data Breach Investigations Report, more than one third (34%) of all data breaches last year were by internal actors. Our own industry research reflects this data. According to a survey we conducted at RSA Conference this year, 40% of organizations report that they either cannot detect insider threats or can only detect them after stolen data has left the organization.
Clearly, it’s a prevalent problem. It’s also a costly problem. Research from the Ponemon Institute reveals that the average cost of a cybersecurity incident involving employees or other insiders is now a staggering $8.7 million.
Insiders are a particular problem in the realm of cybersecurity. External attackers must first breach an organization’s perimeter and then search the network for valuable data before being detected. But insiders already know where that proverbial gold resides – and how to access it.
Who Are These Insider Threats?
When most people think of the “insider threat” there are usually some common stereotypes that spring to mind. Often people conjure up an image of the nefarious insider threat being some malevolent super villain straight out of a 60s James Bond flick.
In reality, the insider threat is more complex. It could be the employee who received a poor performance review and is now itching to “get even” with the company he thinks mistreated him. Or perhaps it’s the rogue IT admin who uses his unmonitored elevated access to snoop out confidential data on the network. How about the former employee who still retains access into key systems, even long after leaving the company? For just one example of this type of insider threat, consider the recent case of a fired employee who pilfered the data of 2.9 million members of the largest credit union in Canada. And this was just last week…
While these insider threat personas exist, the totality of the problem is far greater. Certainly, some insiders truly are malicious. But, in reality, any employee in your organization with access to critical systems and sensitive data might be an up-and-coming insider threat.
Many data breaches originating from within an organization are simply due to the carelessness of employees. These unintentional insider threats (like users clicking on phishing email links) account for 25% of all data breaches. Saying that humans are the weakest link in security may sound like a cliché. But there’s truth to the adage. After all, humans operate most of the computers and devices in your organization – and humans make mistakes.
Thwarting the Insider Threat
Conventional cybersecurity tools offer little when it comes to defending against insider threats. In each of the different types of insider threat personas above, there’s a common factor of having access to “the goods” on the network. Of course, employees and contractors need access to certain systems and applications to do their jobs. The price paid for such access is intentional or accidental misuse of these privileges.
Overworked and undermanned cybersecurity teams simply cannot manually monitor every action taken by every employee in their organizations. However, modern machine learning algorithms can automatically track and analyze employee behavior to identify anomalous and suspicious activities. These activities could range from an accountant who downloads a confidential file he never looked at before, to a salesman who suddenly starts emailing large volumes of customer data to his personal account.
Machine learning allows organizations to compare current user behavior to baselined “normal” behavior. From there, they can identify suspicious trends and spot outliers to remediate threats. The behavior is the “tell”. And, in the two potential insider threat cases stated above, the user’s suspicious behavior would be flagged as risky and anomalous.
Detecting high-risk users with abnormal behaviors through machine learning and statistical analysis is a force multiplier. It exposes anomalies among enormous volumes of data that humans or traditional security tools could never identify.
Uncover Insider Threats with Gurucul Risk Analytics
Our customers are predicting, detecting and stopping insider threats with Gurucul Risk Analytics (GRA). GRA creates a contextual linked view and behavior baseline from various systems – HR records, accounts, activity, events, access repositories, security alerts and more. It identifies out-of-norm behaviors, provides risk prioritized alerts and helps organizations spot high-risk profiles in real-time.
As new activities are consumed, those activities are compared to the baseline behaviors. Behavior that deviates from the norm is classified as an outlier to be dealt with.
Want to learn more? Download our whitepaper Uncover Insider Threats Through Predictive Security Analytics.
You can also request a demo to learn how Gurucul can help you detect and defeat insider threats in your organization.