Digital Shadows Contributes to Insider Threat Research
August 9, 2018
On July 30, Forrester published its latest research report on malicious insiders, Defend Your Data As Insiders Monetize Their Access. With research content provided by Digital Shadows, the report details how insiders with valuable data or privileged access are using online forums and marketplaces to find buyers. At the same time, cybercriminals are using these same platforms to actively recruit insiders from a variety of industries. As many of these criminal forums are located on the clear web, it’s a reminder that we shouldn’t hyper focus on dark web sources alone.
Risks to financial services, retail and healthcare
One of the findings in Forrester’s report is that organizations in the financial services, retail and healthcare industries have some of the highest risk when it comes to malicious insiders. With organizations in these industries handling so much sensitive customer data (think personally identifiable information (PII), health records and payment card details), this is hardly a surprise.
In one our previous blogs, Five Threats to Financial Services: Part One, Insiders, we looked in greater depth at some of the issues financial services organizations should consider when monitoring for insiders, including cybercriminals on the lookout for accomplices with access to SWIFT banking systems, and the emergence of dedicated sites for individuals looking to sell insider trading information.
Telecommunications insiders and SIM-swapping
While the above industries are extremely valuable from an insider perspective, Forrester also stresses that any number of industries dealing with sensitive intellectual property or customer data can be susceptible to this threat. These include manufacturing, technology and telecommunications.
Figure 1: User on a Russian-language forum requesting healthcare insiders (Translation: “Looking for doctors heading hospital departments or directors of private clinics”)
For the telecommunications industry specifically, there is a demand for insiders who can facilitate SIM-swapping or -hijacking attacks. SIM-swapping plays on a technique that millions of people do every year when transferring phone numbers to a new mobile network. Here an attacker will typically contact a target’s network provider and use social engineering techniques to convince network support staff to switch calls and texts to a new SIM that they control. From here they can bypass two-factor authentication methods such as those used in online banking accounts.
In the criminal forum post below (Figure 2), a user claimed to have multiple workers operating at three large UK network providers who were able to perform SIM swaps.
Figure 2: Criminal forum user offering SIM swapping services (Screenshot taken from Digital Shadows platform)
Don’t forget the accidental insider
One area that was out of the scope of the insider report, but should nonetheless be high on the radar of all organizations, is the risk associated with accidental insiders. Unlike cognizant and malicious individuals looking to peddle their privileged access or sensitive company information, an accidental insider is instead an employee who has unwittingly compromised their organization through poor security practices. In many of the examples of sensitive exposure that we see, it’s the case of innocent staff leaving sensitive systems exposed to the public Internet, misconfiguring their devices, or sending highly confidential data to unsecured locations in the cloud.
Our previous whitepaper, Too Much Information, demonstrated how employees, contractors and third parties are often responsible for some of the most serious security breaches by misconfiguring network file sharing services and storage solutions such as Amazon S3 and Network Attached Storage (NAS) drives. A prime case is that of the contractor performing penetration tests. In the example below (Figure 3), a penetration testing company uploaded a lengthy report detailing all of an organization’s outdated servers, missing patches and network infrastructure. Why go to all of the trouble of recruiting and paying a company insider, along with the risk of exposure that entails, when sensitive company secrets are freely available online?
Figure 3: Screenshot of penetration test report contents page exposed through misconfigured file sharing service
Likewise, in our latest join research paper, ERP Applications Under Fire, we found examples where employees and third parties had left full login credentials for critical Enterprise Resource Planning applications on public Trello boards, a cloud-based project management tool.
Figure 4: ERP credentials left exposed on open Trello board
Securing your organization from accidental insiders
Preventing breaches and exposure through accidental insiders requires a mixture of technology, process and training. For organizations looking to minimize this threat, consider the following:
- Provide security awareness training for all staff, including contractors and third parties. This should also cover the risks of using home NAS drives for company data and archiving files using file sharing services.
- If employees and contractors need to use NAS devices, then users should add a password and disable guest/anonymous access, as well as opt for NAS devices that are secured by default. If possible, you should look to offer backup solutions so that contractors and employees don’t feel the need to back-up their devices at home.
- Ensure two-factor authentication (2FA) is enabled across the organization where possible. This will help prevent unintentionally leaked credentials being leveraged by malicious actors.
- Restrict access to important data to only those who are required to have it. Read/write access should only be granted where there is an explicit business requirement.
- Monitor your external footprint for cases of accidental data loss and exposure. Document Loss Prevention solutions can help identify cases where sensitive information has left your estate.