Tagged: threat


ADT Breach Reveals Insider Threats are Still a Major Issue

From the US District Attorney’s Northern District of Texas Office – We learned this past week that insider threats are still a serious risk to organizations and their customers. A technician working for ADT pleaded guilty to accessing customer accounts and watching them in their homes using the live feed functions of home security systems.

The press release indicates this was a “hack” but in reality it wasn’t a hack. There was no hacking involved. This was a technician granted privileged access to the ADT network who then used those privileges to access data without reason. A hack implies that the person or entity that gained access to a system or data did so despite the fact they had no defined ability to do so. Mr. Aviles clearly had access to the systems in question to make changes and thereby obtain access into other areas of the system including the live security feeds in customer accounts.

As shocking as this incident may seem to the public, it points to an issue that information security practitioners and internal auditors have known for years. Internal threats posed by staff, vendors, and contractors are some of the most significant that an organization faces. These threats can come from people acting maliciously, as in the case of Mr. Aviles, or from people acting from a position of ignorance or carelessness. The prime examples of these types of unintentional threats might be staff members falling for phishing attacks, leaving information unsecured, sending information to a wider audience than appropriate, etc.

To combat these threats, companies need these key systems and controls in place:

  • Strong detective capabilities in terms of who is accessing what systems, how often those systems are being accessed, and the ability to corelate actions in systems to legitimate business need.
  • Strong internal auditing processes that routinely and randomly validate that detective controls are working as designed and escalating anomalies to management and independent supervisory auditors.
  • Regular review of system activity pattern changes when staff are out on PTO versus when they are in the office.
  • Strong ethical guidelines where there is a zero tolerance policy taken towards infractions of the organizations code of conduct for staff.
  • Regular and frequent reinforcing of the code of conduct for those staff that have access to privileged systems and data.

There is no question that insider threats will impact companies sooner or later regardless of the controls in place. However, It is imperative that organizations show that they take the threats seriously and that they can demonstrate strong controls. Would different controls at ADT stopped Mr. Aviles before he could cause this damage? We don’t know and probably will not know. We can only hope that other organizations learn from this incident and do more to increase their own protective controls over customer data and accounts.


Your People Are Your Biggest Threat

The Hacker News has an article posted from November 7th about a rogue TrendMicro employee stealing customer data and selling it to a tech support scammer. This goes to show, once again, that your people are always your biggest threat. Whether they are clicking on malicious links in from that prince who sent them an email or actively stealing data to sell on the black market, they are likely going to do something to cause you serious pain. Many companies don’t know how to combat these threats or are completely oblivious to what their people may be doing. Here are some ideas to help protect your organization:

  1. Invest in training – Train, train, train, and then train your staff again to be vigilant and know how to recognize a malicious email, phone call, or text message before they divulge any information. If they fall for one, deliver on-the-spot training to help them learn from their mistake.
  2. Invest in more than your average anti-virus software – Advanced Persistent Threats (APTs) are the buzzword of the decade. While you don’t need to listen to all the marketing hype, you should have a host based security solution on your PCs and servers that does more than just look for known signatures. It needs to identify unknown threats as well as known threats, block ransomware, stop data being transferred to removable storage, and more.
  3. Adopt a policy of least privilege – Does that receptionist really need local administrative privileges on their PC? Does that staff trainer really need access to the marketing database? I don’t think so. If people don’t need access to data, make sure they can’t get to it.
  4. Classify your data – What is in that random word document on the accounting shared drive? Is it something that shouldn’t leave the building? If it is, make sure you are tagging the document and putting restrictions in place on your firewalls to stop it from leaving. Do this for all of your data and put rules in place to protect it where it is stored.
  5. Invest in Data Loss Prevention (DLP) tools – Make sure data isn’t leaving your organization. Have tools that can observe data movement, alert, and stop it from happening if needed.
  6. Protect your data from and in the Cloud – Invest in Cloud Access Security Brokers (CASBs) if you allow your staff to store data and work in the cloud. You don’t want data stored improperly in services like Slack, Office 365, Dropbox, Gmail, or somewhere else.

There are many other things you could do as well, but I would argue if you have these tools in place and configured properly, you just might avoid ending up like TrendMicro.