Knowing Your Enemy Part 3.

Hi, welcome to the next instalment of our "Knowing Your Enemy" blog series.

This week we are going to focus on the “The Insider” and what type of vulnerabilities this type of actor is looking to exploit and how. 

The Privileged Employee, or the Insider Threat

The name speaks for itself. The insider, often an employee with privileged access to sensitive data, may willingly or unwillingly be part of a cybercrime operation.

The insider may compromise the company they work for on purpose through sloppiness or through external influence. Alternatively, they may have been a victim of a scam or blackmail.

This ambiguity of his nature often makes insiders the hardest to foresee and counter. In other words, cyber-defences should start with the insider.

Ok, so this threat actor could be extremely dangerous, as they are already inside the outer security perimeter and able to perform an advanced, persistent threat (APT) to an organisation.

They are usually concerned with data theft, possibly with a monetary gain but usually they are disgruntled employee’s out to cause damage to a system. 

How does traditional IT Health Checks and Penetration testing activity cope with this type of threat, well very poorly and there is too much emphasis placed defining specific systems within the scope of testing, rather than allowing a testing team the ability to diversify throughout the environment.

Internal red-teaming would be one way to allow a more effective type of assessment, although this would be difficult to scope and manage in practice. Allowing an external company, the freedom to choose target’s in a live, production environment can be extremely daunting for any business, as the potential for disruption is high.

A solution that can safely automate the typical attack vectors that would emanate through malware payloads or malicious insider actions would be a fair, cost effective solution to the problem.

So what does this mean in practice.  

Well in order to evaluate the threat posed by a malicious insider, you need to look at the entire environmental eco-system as a whole, this includes the user settings on the end user devices, whether it be a Windows workstation that receives group policy updates, or a mobile device that uses a mobile device management system, it could also be an environment where users can bring their own devices which an organisation has little control over the configuration of. 

Then what about the network layer, what ingress and egress points are there in and out of the network, can a user post sensitive data to website forums or connect to malicious malware infested websites.

Removable media is always a prime target for spreading malware, along with emails and malicious websites, so anti-virus, anti-malware, anti-spam and IDS all need to be tested under the guise of a malicious insider.

Fortunately, the industry is catching up and providing solutions to this type of assessment, whether it be through a customised virtual machine (as provided by red wolf security) or through a malware simulation test kit (as provided by Lucy Phishing server) there are options out there that should be adopted and incorporated into the risk management process.

Links

LUCY Phishing Server - Malware Simulation Test

Insider Threat Testing - Red Wolf Security

Conclusion

Insider threat testing is an essential part of modern security testing. Performing server build reviews, internal network security assessments, firewall rule base reviews etc is all well and good and still has a major part to play in the IT Health Check process.

Although if you are not performing internal Red team assessments, using customised malware on a regular basis (which would be ideal, but extremely expensive and could be problematic on a production environment), then adopting an automated tool kit such as those mentioned in this post, alongside the more traditional assessment methodologies, then you are covering the bases.

Progressive and forward thinking security testing Consultancies are adopting this type of testing within their service offerings and methodologies, which can allow them to perform a more pragmatic approach to risk analysis.