How has insider threat evolved in the past few years?
Insider threat has become more prevalent and sophisticated in recent years, thanks in large part to identity theft being such big business. According to the Identity Theft Resource Center (ITRC), as of April, 167 breaches were reported in U.S. so far in 2008, accounting for 8,391,871 exposed personal records. What’s more, according to the Computer Security Institute’s (CSI) 12th Annual Computer Crime and Survey from September 2007, insider threat was up by 17 percent. There is definitely a correlation between these figures:
Identity theft is often driven by international organized crime groups that solicit customer data and credit cardholder information via Internet chat rooms in exchange for large sums of money. These organized crime entities—which are beyond the reach of U.S. law—often contact “trusted” users within large organizations and ask them to access databases to obtain information that can be exploited. Ex-employees who are aware of lax security practices will “ping” accounts to see if they can still access or sell information about what an organization has—or has not—done to protect its vital data. Insiders have intimate details about the company’s efforts to protect proprietary systems and information, and they possess the skill set and knowledge required to exploit any existing gaps. All they need is a motive, which can be money, revenge or even just the chance to embarrass a current or former employer.
Two recent examples of insider threat (with very costly consequences) include the Société Générale fiasco and Tenet Healthcare incident. In January 2008, it was discovered that a Paris-based Société Générale trader committed fraud to the tune of $7.2 billion (with an additional loss of $50 million to cover forced short sale of assets). This trader previously held a position within the IT department and used the privileged access rights he was given in that role to create and conceal “dummy” accounts. In February 2008, a former Tenet Healthcare employee accessed the records of more than 37,000 patients and stole 90 identities before he was caught.
What are the main challenges of controlling access to proprietary systems?
Controlling access requires both a cultural and procedural change, as well as implementing the right technologies to restrict and monitor end-user and administrator access to applications, databases, files and systems. Most IT managers will agree that privileged accounts/access represent the greatest opportunity for fraud to occur in IT systems. However, many privileged users will ask, “Why can’t I have access to all those systems; I always have in the past?” This is precisely the attitude that must change.
Unfortunately, many IT departments are used to lax security (for example, no security measures for “super-user” accounts or using vendor-supplied default passwords because it is easier than setting up the alternatives processes and allocating budget). Many organizations do understand the importance of internal security, but just as many would rather not be bothered. If there were not compliance laws being enforced, many companies would likely choose to do nothing and take their chances. But good security breeds compliance, and things like logging activity and controlling access are important to deter fraud as much as they are for compliance (as well as “proof of innocence”).