Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/31/2017
02:00 PM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

The Case for Disclosing Insider Breaches

Too often organizations try to sweep intentional, accidental or negligent employee theft of data under the rug. Here's why they shouldn't.

Stolen credentials are often the entry point attackers use to access sensitive data, and often the first thing to come to mind is a cyber activist with an ax to grind, or a state-sponsored crime ring bent on financial gain or IP theft. But executives would do well to recognize that their own employees can play a significant role in compromising their organizations’ cybersecurity. Insider threats – accidental and inadvertent, or deliberate and malicious – are becoming increasingly common as technology rapidly evolves and employee education struggles to keep pace.

We rarely see accurate data regarding the scope of the problem when it comes to accidental or negligent employee insider threats. And unfortunately, organizations often try to sweep these breaches under the rug. As a CISO, I can sympathize with many organizations’ hesitation to include full breach details. Here’s why:

  • It will tarnish their brand. Companies want their customers to trust them especially as they are the keepers of more customer data than ever before. A breach can seriously erode that perception, and get customers thinking twice before they buy next time.  
  • It’s expensive, and embarrassing! Regardless of the fact, many companies feel a breach reflects a failure on their part, and revealing the details may open them up to further questions about their practices and policies. Plus, cleaning up after a breach can also be very costly.    
  • They aren’t required to disclose the breach. Right now, there are a patchwork of breach notification laws that can vary by state, industry and breach type. However, with emerging regulations such as the GDPR, we can expect to see a change.

These are all valid concerns. And although on the surface the consequences seem to greatly outweigh the benefits, hear me out…

I think organizations should seek to help one another by fully (or at least to the furthest extent possible) disclosing insider breaches whether they are malicious or inadvertent. This would help organizations better understand their adversaries and demonstrate where they need to focus cybersecurity training and education efforts.

Not convinced?

During the summer and fall 2016, a DuPont employee copied and removed thousands of files containing DuPont’s proprietary information including formulas, data, and customer information. Shortly after, the employee announced his retirement while simultaneously opening his own consulting business. Prior to his exit, another DuPont employee caught him taking photos of DuPont’s equipment with his personal phone. Without going into too much detail, the incident was reported up the management chain and naturally escalated from there. DuPont brought the alleged theft to the FBI and disclosed all the information they had up to this point.

The employee was at DuPont for 27 years. This, no doubt, could have seriously damaged DuPont’s reputation if they had not taken the appropriate approach. DuPont had the ability to quickly and quietly sweep this under the rug. Instead, the company gathered as much information as they could, reported the insider to the authorities, and demonstrated how it is very possible for other organizations do the same.

I applaud DuPont’s approach and will use this example to break down the advantages of disclosing insider breaches:

  • You get in front of the story (and the backlash). Suppose DuPont decided to keep this information to themselves. There is a good chance that eventually someone, somewhere would have figured it out. Instead, they were direct and upfront about the incident.
  • It enables companies to band together. We learn from each other’s mistakes! I have no doubt that organizations caught wind of DuPont’s approach and trained their employees on spotting insider threats. If it had been due to negligence or an inadvertent mistake, this would have also been a teachable moment.
  • There’s data for developing mitigation strategies. This can help inform an organization, or even best practices within an entire industry. Data can help reveal where the threats are and the scope and size of the problem.

So, the real question is, will organizations’ mentality ever change? When will they begin to realize the benefits of disclosing breaches to help one another out and work toward the greater good?

In highly regulated industries, we are beginning to see change. As regulations around data become more prevalent (as we are seeing in the EU and beyond), publicly-traded companies will be required to explain how breaches occurred within a fully developed breach report. It’s the smaller and self-contained industries and businesses that we will continue to rarely hear about; they tend to keep the classified information that they contain and clean up in-house.

Insider threats are some of the most serious threats a company can face. By disclosing and sharing the comprehensive data we collect on real-world incidents, we can better educate employees, reduce the success of malicious actors and build more secure environments and stronger overall organizations. 

Check out the all-star panels at the 'Understanding Cyber Attackers & Cyber Threats' event June 21 and get an in-depth look at your cyber adversaries. Click here to register. 

Related Content:

With 15-plus years of leadership experience implementing vendor security risk and assessment programs for startups and Fortune 500 companies, Jackson defines the security road map for SecureAuth's suite of adaptive authentication and IS solutions. Prior to joining SecureAuth, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16246
PUBLISHED: 2019-12-12
Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution.
CVE-2019-17358
PUBLISHED: 2019-12-12
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP ...
CVE-2019-17428
PUBLISHED: 2019-12-12
An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.
CVE-2019-18345
PUBLISHED: 2019-12-12
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrat...
CVE-2019-19198
PUBLISHED: 2019-12-12
The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.