Also, the increased adoption of ... Systems, Inc. (NASDAQ:VRNS)’s strong position in data security, together with the higher prioritization of cybersecurity investments by organizations, continues to create a positive market environment....

Varonis Systems, Inc. (VRNS) Leverages AI for Data Security Growth - Insider Monkey

We recently published a list of 10 AI News Updates Making Waves on Wall Street.

Alibaba Group Holding (BABA) Commits $52.4 Billion to AI and Cloud Infrastructure Growth - Insider Monkey

SAN JOSE, Calif., Feb. 25, 2025 (GLOBE NEWSWIRE) — DTEX Systems, the trusted leader of insider risk management, today announced the findings of the 2025 Cost of Insider Risks Global Report, independently conducted by the Ponemon Institute. For the first time since the inception of the report, ...

Ponemon Cybersecurity Report: Insider Risk Management Enabling Early Breach Detection and Mitigation — TradingView News

We recently compiled a list of the Top 10 AI Stocks on the Move and on Analysts' Radar. In this article, we are going to take a look at where Open Text Corporation (NASDAQ:OTEX) stands against the other...

Open Text Corporation (OTEX) Unveils AI-Powered Cybersecurity Solution - Insider Monkey

Professor of Information Systems, Research Chair in Critical Infrastructure, University of Canberra · Associate Professor of Cyber Security, University of Canberra

Insider threat: cyber security experts on giving Elon Musk and DOGE the keys to US government IT systems

Insider Gaming sources have said that Ubisoft and its developers are confident that Assassin's Creed Shadows will launch on March 20, 2025.

EXCLUSIVE - Ubisoft is Confident on Releasing Assassin's Creed Shadows on March 20, 2025 - Insider Gaming

According to the game's director, publisher NetEase has laid off multiple developers on Marvel Rivals, including an entire US-based team.

Marvel Rivals Developers Laid Off As NetEase Guts An Entire Team - Insider Gaming

Ubisoft has just revealed Siege X at the Six Invitational in Boston. It promises to keep the game going for another ten years.

Rainbow Six Siege Will Be Around For Another 10 Years with Siege X - Insider Gaming

Insider.

insider

The $1.4 billion hack of the Bybit exchange is a natural thunderclap. First, the amount of stolen cryptocurrency is staggering in scope. Secondly, the security systems of large CEX platforms are considered to be quite reliable and elaborate, but it seems that this is not the case. Entire companies (Arkham) and individual experts (ZachXBT) are looking for signs of outside influence and the path of funds to find out who the funds will lead to. In the meantime, anonymous security expert Dexaran, author of ERC-223 and head of Ethereum Commonwealth, has looked deeper into the attack itself and revealed that the defense mechanism wasn't really that robust, and that someone inside Bybit could conceivably be involved in the hack. Multisig has proven to be unreliable. The vast majority of exchanges use multisig wallets to store assets. In fact, it is a special smart contract that can only be acted upon if the persons involved in the management approve the proposed action with their signatures. Such smart contracts can be updatable, i.e. have a bundle of a proxy contract that stores data and an implementation contract - the logic to be executed. Dexaran in one of his posts gives the address of the proxy contract of the attacked Bybit cold wallet using Gnosis Safe as the implementation contract, rightly noting that it is a rather complex contract of 1080 lines. It may well be that the Bybit team never utilized the full functionality of Gnosis Safe. Most likely, the choice of a smart multi-signature contract was influenced by the widespread adoption of Gnosis Safe. In the meantime, complexity often leads to redundancy and misunderstanding of code behavior in complex situations, one can recall the incorrect user interaction with Gnosis Safe and the loss of $25 million. The Achilles' heel of the multisig used turned out to be signatures, or rather, how and with what help they are generated. As Dexaran notes, signatures are very complex and unreadable by humans, which means that most likely software is used to generate them, and the process itself is the same for all participants, the researcher suggests. That's why other members of the Bybit team didn't suspect anything, because everything looked as usual, and they couldn't read the substitution of Bybit's hot wallet for the hacker's wallet because of the complexity of the signature provided by the hacker. There is no reason not to trust Dexaran's expertise. He has extensive experience auditing smart contracts since the Ethereum split. He audited the multisig wallet for Ethereum Classic, developed the ERC-223 standard and the smart contract communication model to solve the ERC-20 problem. Why would a hacker be inside Bybit? Sure, the Gnosis Safe contract and the proxy contract are verified in the Etherscan block browser, anyone can read the code, the hacker could just be a smart guy. However, the fact that he clearly knows how signatures are generated is either a rare coincidence and a lucky break for the hacker, or he simply knows the inner workings of Bybit's security system from his direct job duties or from an informant. In addition, the hacker didn't just walk by, he deployed two copies of the target contract for practice the day before. Hacker trails A researcher under the nickname ZachXBT traced the flow of funds to an address that accumulated funds from the Phemex hack. This fact is taken as proof of Lazarus Group involvement in the Bybit hack. Considering that a hacker or group of hackers was crushing the funds and withdrawing them through various bridges and mixers, the researcher has done a Herculean task. \In turn, Dexaran draws attention to the chain of addresses, through which the hacker's addresses were replenished to pay for gas for calls to test contracts and send a transaction with a signature to withdraw funds from the exchange's cold wallet. It turns out the hacker funded his addresses through the Binance exchange. Binance is fully compliant with KYC/AML policies and is quite willing to work with various law enforcement agencies. Of course, hackers use the so-called “money mule”, but it's still a clue when an exchange cooperates with law enforcement. Community reaction. Call for the abolition of decentralization. As soon as it became known that the exchange had been hacked and an astronomical amount of ETH had been withdrawn, the market experienced selling pressure. Traders obviously rushed to hedge their bets believing that hackers would cash out the stolen money. CoinMarketCap After the opening of withdrawals from the exchange, users also rushed to withdraw their funds, resulting in an outflow of $5.3 billion (DeFi Llama). Various companies have gotten involved in tagging stolen funds and limiting the ability for hackers to use different platforms to mix and transfer funds between blockchains. Tether - the issuer of USDt - block hackers' funds (Paolo Ardoino). However, not everyone is moving in unison. Cryptomixer eXch has refused to cooperate with the exchange. “In light of these circumstances, we would like an explanation as to why we should partner with an organization that has actively defamed our reputation,” eXch wrote in a response posted on the Bitcointalk forum. Amazingly, there are people calling for a rollback of the Ethereum blockchain to recover Bybit funds, one of them Jan3 CEO Samson Mow. These calls sound a bit strange, when ordinary users who lose their funds are accused of negligence. It's not uncommon for users to mistakenly send funds to the exchange from the wrong EVM network, and all the exchange needs to do is use a public node to send the user's funds back, but in 99.9% of cases they refuse. Plus Bybit has assured that it has enough reserves to cover all losses. These people unknowingly call for burying all the efforts made by the blockchain industry by completely abolishing decentralization, thus reducing the very value of public blockchain technology to 0. Fortunately, the developers of Ethereum themselves are against such a move, and have more than justified their position. for example, kernel developer Tim Beiko. And they have enough supporters on this issue advocating decentralization and cryptopunk philosophy, such as Justin Bons. Bybit itself launched a bounty program, thus announcing a hunt for hackers involved in the hack. Conclusion The community is used to periodic hacks of DeFi protocols. On these platforms developers often neglect testing procedures and audits, choose modules whose code and logic they don't fully know. All in favor of development speed and fear of missing the wave. That's why CEX hack, especially a large one, is always a high-profile event that leaves a lasting impression on the whole industry. Developers at all levels should not forget that the race of defense mechanisms and hacking tools is non-stop and should be on guard. The $1.4 billion hack of the Bybit exchange is a natural thunderclap. First, the amount of stolen cryptocurrency is staggering in scope. Secondly, the security systems of large CEX platforms are considered to be quite reliable and elaborate, but it seems that this is not the case. Entire companies ( Arkham ) and individual experts ( ZachXBT ) are looking for signs of outside influence and the path of funds to find out who the funds will lead to. In the meantime, anonymous security expert Dexaran , author of ERC-223 and head of Ethereum Commonwealth , has looked deeper into the attack itself and revealed that the defense mechanism wasn't really that robust, and that someone inside Bybit could conceivably be involved in the hack. Arkham Arkham ZachXBT ZachXBT Dexaran Dexaran ERC-223 ERC-223 Ethereum Commonwealth Ethereum Commonwealth revealed revealed Multisig has proven to be unreliable. The vast majority of exchanges use multisig wallets to store assets. In fact, it is a special smart contract that can only be acted upon if the persons involved in the management approve the proposed action with their signatures. Such smart contracts can be updatable , i.e. have a bundle of a proxy contract that stores data and an implementation contract - the logic to be executed. multisig multisig updatable updatable Dexaran in one of his posts gives the address of the proxy contract of the attacked Bybit cold wallet using Gnosis Safe as the implementation contract, rightly noting that it is a rather complex contract of 1080 lines. It may well be that the Bybit team never utilized the full functionality of Gnosis Safe. Most likely, the choice of a smart multi-signature contract was influenced by the widespread adoption of Gnosis Safe. In the meantime, complexity often leads to redundancy and misunderstanding of code behavior in complex situations, one can recall the incorrect user interaction with Gnosis Safe and the loss of $25 million. proxy contract proxy contract interaction interaction The Achilles' heel of the multisig used turned out to be signatures, or rather, how and with what help they are generated. As Dexaran notes , signatures are very complex and unreadable by humans, which means that most likely software is used to generate them, and the process itself is the same for all participants, the researcher suggests. notes notes That's why other members of the Bybit team didn't suspect anything, because everything looked as usual , and they couldn't read the substitution of Bybit's hot wallet for the hacker's wallet because of the complexity of the signature provided by the hacker. as usual as usual There is no reason not to trust Dexaran's expertise. He has extensive experience auditing smart contracts since the Ethereum split. He audited the multisig wallet for Ethereum Classic, developed the ERC-223 standard and the smart contract communication model to solve the ERC-20 problem . audited audited ERC-20 problem ERC-20 problem Why would a hacker be inside Bybit? Sure, the Gnosis Safe contract and the proxy contract are verified in the Etherscan block browser, anyone can read the code, the hacker could just be a smart guy. However, the fact that he clearly knows how signatures are generated is either a rare coincidence and a lucky break for the hacker, or he simply knows the inner workings of Bybit's security system from his direct job duties or from an informant. In addition, the hacker didn't just walk by, he deployed two copies of the target contract for practice the day before. deployed deployed Hacker trails A researcher under the nickname ZachXBT traced the flow of funds to an address that accumulated funds from the Phemex hack . This fact is taken as proof of Lazarus Group involvement in the Bybit hack. Considering that a hacker or group of hackers was crushing the funds and withdrawing them through various bridges and mixers, the researcher has done a Herculean task. traced traced Phemex hack Phemex hack Lazarus Group Lazarus Group \In turn, Dexaran draws attention to the chain of addresses, through which the hacker's addresses were replenished to pay for gas for calls to test contracts and send a transaction with a signature to withdraw funds from the exchange's cold wallet. It turns out the hacker funded his addresses through the Binance exchange. Binance is fully compliant with KYC/AML policies and is quite willing to work with various law enforcement agencies. Of course, hackers use the so-called “money mule”, but it's still a clue when an exchange cooperates with law enforcement. draws draws Community reaction. Call for the abolition of decentralization. As soon as it became known that the exchange had been hacked and an astronomical amount of ETH had been withdrawn, the market experienced selling pressure. Traders obviously rushed to hedge their bets believing that hackers would cash out the stolen money. CoinMarketCap CoinMarketCap CoinMarketCap After the opening of withdrawals from the exchange, users also rushed to withdraw their funds, resulting in an outflow of $5.3 billion ( DeFi Llama ). DeFi Llama DeFi Llama Various companies have gotten involved in tagging stolen funds and limiting the ability for hackers to use different platforms to mix and transfer funds between blockchains. Tether - the issuer of USDt - block hackers' funds ( Paolo Ardoino ). involved involved Paolo Ardoino Paolo Ardoino However, not everyone is moving in unison. Cryptomixer eXch has refused to cooperate with the exchange. “In light of these circumstances, we would like an explanation as to why we should partner with an organization that has actively defamed our reputation,” eXch wrote in a response posted on the Bitcointalk forum. “In light of these circumstances, we would like an explanation as to why we should partner with an organization that has actively defamed our reputation,” eXch wrote in a response posted on the Bitcointalk forum. Bitcointalk Amazingly, there are people calling for a rollback of the Ethereum blockchain to recover Bybit funds, one of them Jan3 CEO Samson Mow. Jan3 CEO Samson Mow . Jan3 CEO Samson Mow These calls sound a bit strange, when ordinary users who lose their funds are accused of negligence. It's not uncommon for users to mistakenly send funds to the exchange from the wrong EVM network, and all the exchange needs to do is use a public node to send the user's funds back, but in 99.9% of cases they refuse. Plus Bybit has assured that it has enough reserves to cover all losses. These people unknowingly call for burying all the efforts made by the blockchain industry by completely abolishing decentralization, thus reducing the very value of public blockchain technology to 0. Fortunately, the developers of Ethereum themselves are against such a move, and have more than justified their position. for example, kernel developer Tim Beiko. Tim Beiko . Tim Beiko And they have enough supporters on this issue advocating decentralization and cryptopunk philosophy, such as Justin Bons. Justin Bons . Justin Bons Bybit itself launched a bounty program, thus announcing a hunt for hackers involved in the hack. launched launched Conclusion The community is used to periodic hacks of DeFi protocols. On these platforms developers often neglect testing procedures and audits, choose modules whose code and logic they don't fully know. All in favor of development speed and fear of missing the wave. That's why CEX hack, especially a large one, is always a high-profile event that leaves a lasting impression on the whole industry. Developers at all levels should not forget that the race of defense mechanisms and hacking tools is non-stop and should be on guard.

Security Expert Says the Bybit Hack May Have Involved an Insider

Sekuriteitskenner sê die Bybit Hack het moontlik 'n insider betrek

يقول خبير أمني إن اختراق Bybit ربما يكون متورطًا فيه شخص من الداخل

Эксперт па бяспецы кажа, што ва ўзломе Bybit мог быць задзейнічаны інсайдэр

Un experto en seguridad afirma que el hackeo de Bybit podría haber involucrado a alguien con información privilegiada

Ekspè Sekirite di Bybit Hack a ka enplike yon Inisye

Pakar Keamanan Mengatakan Peretasan Bybit Mungkin Melibatkan Orang Dalam

セキュリティ専門家、バイビットのハッキングには内部関係者が関与していた可能性があると主張

Nilaza ny manam-pahaizana momba ny fiarovana fa mety ho tafiditra ao anatin'ny atiny ny Hack Bybit

Pakar Keselamatan Berkata Hack Bybit Mungkin Melibatkan Orang Dalam

ආරක්ෂක විශේෂඥයෙක් පවසන්නේ බයිබිට් හැක් කිරීම අභ්‍යන්තරිකයෙකු සම්බන්ධ වී ඇති බවයි.

Nyanzvi Yekuchengetedza Inoti iyo Bybit Hack Inogona kunge Iine Mukati

பைபிட் ஹேக்கில் ஒரு உள் நபர் ஈடுபட்டிருக்கலாம் என்று பாதுகாப்பு நிபுணர் கூறுகிறார்.

Hey Hackers! As someone who has been writing for years, it can sometimes appear that making it on the first few pages of Google is just a random game of chance. But there are things you can do to increase those chances. Today, we’ll talk about the importance of the meta description and how it can take you to the top of Google. What Is the Meta Description? The meta description is exactly what it sounds like: it describes what your article is about and what readers can expect from it. You can find the meta description box in the story settings. Why Is the Meta Description Important? The reason it’s so important is that Google will analyze your meta description and determine how relevant it is to the keywords. For example, if you write an article about the newest iOS update, and your meta description has zero mention of iOS, iPhone, Apple, or any relevant keywords, Google won’t prioritize it and won’t push it. That’s why it’s essential to capitalize on meta descriptions and make the most out of them. And if you need help writing them, we got you covered. Also need help with story tags? Check out our previous article to learn how to up your tag game. How to Write Meta Descriptions Writing meta descriptions can appear simple, but it takes a little finesse. If you go to the meta description box and just start spamming keywords, that won’t get you anywhere. This is an example of a bad meta description: “ios new update apple new update iphone update new iPhone update apple updates apple news” Now, there’s a slim chance that this can work out in your favor, but it’s not likely. You’ll increase your chances of a better ranking on Google by thinking out your description, and not just trying to take the easy route. This is an example of a good meta description: The new iOS 20.5 update introduced new features such as updated security protocols and new emojis. Here's every single feature of the new iOS update explained. Notice how we have “iOS 20.5 update” and “new iOS update” in the meta description. These are keywords that we’re targeting, and putting them in the meta description will hopefully give us a leg up against other articles talking about the same thing. And that’s it! We now have a good meta description that we can be proud of. To recap, here are the important points you need to remember: The meta description can’t just be buzzword after buzzword; they have to be clear and concise sentences.
Try to add 2 keywords to your meta description (It’s also important to add these words into your title and throughout your article).
The meta description can only be 160 characters, so don’t add unnecessary words. With these tips, and with your talent, we know your articles will shoot up in the Google stratosphere. Put your newly acquired skills to use! Use this template to let us know what everyone should know. It could be about the latest Apple update, useful coding tips, or things going on in the world around us. But wait. There’s More! Did you know HackerNoon is always running writing contests where the winning writers can earn money?? Here are the 5 we currently have going on: The #blockchain-api Writing Contest by dRPC ($1,000 in total prizes)
The #bitcoin Writing Contest by Rootstock ($17,500 in total prizes)
The Opt-Out Writing Contest by Āut Labs (9,000 USDT in total prizes)
The #crypto-api Writing Contest by CoinGecko ($1,000 in total prizes)
The #decentralize-ai Writing Contest by ICP ($1,000 in total prizes)
The #ethereum Writing Contest by DeGate ($1,000 in total prizes) See you next time! Hey Hackers! As someone who has been writing for years, it can sometimes appear that making it on the first few pages of Google is just a random game of chance. But there are things you can do to increase those chances. Today, we’ll talk about the importance of the meta description and how it can take you to the top of Google. meta description What Is the Meta Description? The meta description is exactly what it sounds like: it describes what your article is about and what readers can expect from it. You can find the meta description box in the story settings. Why Is the Meta Description Important? The reason it’s so important is that Google will analyze your meta description and determine how relevant it is to the keywords. For example, if you write an article about the newest iOS update, and your meta description has zero mention of iOS, iPhone, Apple, or any relevant keywords, Google won’t prioritize it and won’t push it. That’s why it’s essential to capitalize on meta descriptions and make the most out of them. And if you need help writing them, we got you covered. Also need help with story tags? Check out our previous article to learn how to up your tag game. Also need help with story tags? Check out our previous article to learn how to up your tag game. article How to Write Meta Descriptions Writing meta descriptions can appear simple, but it takes a little finesse. If you go to the meta description box and just start spamming keywords, that won’t get you anywhere. This is an example of a bad meta description: “ios new update apple new update iphone update new iPhone update apple updates apple news” “ios new update apple new update iphone update new iPhone update apple updates apple news” Now, there’s a slim chance that this can work out in your favor, but it’s not likely. You’ll increase your chances of a better ranking on Google by thinking out your description, and not just trying to take the easy route. This is an example of a good meta description: The new iOS 20.5 update introduced new features such as updated security protocols and new emojis. Here's every single feature of the new iOS update explained. The new iOS 20.5 update introduced new features such as updated security protocols and new emojis. Here's every single feature of the new iOS update explained. Notice how we have “iOS 20.5 update” and “new iOS update” in the meta description. These are keywords that we’re targeting, and putting them in the meta description will hopefully give us a leg up against other articles talking about the same thing. And that’s it! We now have a good meta description that we can be proud of. To recap, here are the important points you need to remember: To recap, here are the important points you need to remember: The meta description can’t just be buzzword after buzzword; they have to be clear and concise sentences. Try to add 2 keywords to your meta description (It’s also important to add these words into your title and throughout your article). The meta description can only be 160 characters, so don’t add unnecessary words. The meta description can’t just be buzzword after buzzword; they have to be clear and concise sentences. Try to add 2 keywords to your meta description (It’s also important to add these words into your title and throughout your article). The meta description can only be 160 characters, so don’t add unnecessary words. With these tips, and with your talent, we know your articles will shoot up in the Google stratosphere. Put your newly acquired skills to use! Use this template to let us know what everyone should know. It could be about the latest Apple update, useful coding tips, or things going on in the world around us. Put your newly acquired skills to use! Use this template to let us know what everyone should know . It could be about the latest Apple update, useful coding tips, or things going on in the world around us. everyone should know But wait. There’s More! Did you know HackerNoon is always running writing contests where the winning writers can earn money?? Here are the 5 we currently have going on: writing contests The #blockchain-api Writing Contest by dRPC ($1,000 in total prizes) The #bitcoin Writing Contest by Rootstock ($17,500 in total prizes) The Opt-Out Writing Contest by Āut Labs (9,000 USDT in total prizes) The #crypto-api Writing Contest by CoinGecko ($1,000 in total prizes) The #decentralize-ai Writing Contest by ICP ($1,000 in total prizes) The #ethereum Writing Contest by DeGate ($1,000 in total prizes) The #blockchain-api Writing Contest by dRPC ($1,000 in total prizes) The #blockchain-api Writing Contest by dRPC The #blockchain-api Writing Contest by dRPC The #bitcoin Writing Contest by Rootstock ($17,500 in total prizes) The #bitcoin Writing Contest by Rootstock The #bitcoin Writing Contest by Rootstock The Opt-Out Writing Contest by Āut Labs (9,000 USDT in total prizes) The Opt-Out Writing Contest by Āut Labs The Opt-Out Writing Contest by Āut Labs The #crypto-api Writing Contest by CoinGecko ($1,000 in total prizes) The #crypto-api Writing Contest by CoinGecko The #crypto-api #crypto-api Writing Contest by CoinGecko The #decentralize-ai Writing Contest by ICP ($1,000 in total prizes) The #decentralize-ai Writing Contest by ICP The #ethereum Writing Contest by DeGate ($1,000 in total prizes) The #ethereum Writing Contest by DeGate See you next time!

Get on Google's Front Page with Effective Meta Descriptions: Insider Tips from HackerNoon Editors

কার্যকরী মেটা বর্ণনা সহ Google এর সামনের পৃষ্ঠায় যান: হ্যাকারনুন সম্পাদকদের কাছ থেকে অভ্যন্তরীণ টিপস

Mit effektiven Meta-Beschreibungen auf die erste Seite von Google gelangen: Insider-Tipps der HackerNoon-Redakteure

Acceda a la página principal de Google con metadescripciones efectivas: consejos de expertos de los editores de HackerNoon

Accédez à la première page de Google avec des méta descriptions efficaces : conseils d'initiés des éditeurs de HackerNoon

प्रभावी मेटा विवरण के साथ Google के फ्रंट पेज पर आएं: HackerNoon संपादकों से अंदरूनी सुझाव

効果的なメタディスクリプションで Google のトップページに掲載される: HackerNoon 編集者からのヒント

효과적인 메타 설명으로 Google의 첫 페이지에 등장: HackerNoon 편집자가 전하는 내부자 팁

Entre na primeira página do Google com meta descrições eficazes: dicas internas dos editores do HackerNoon

Попадитесь на главную страницу Google с эффективными метаописаниями: советы инсайдеров от редакторов HackerNoon

Etkili Meta Açıklamalarıyla Google'ın Ön Sayfasına Çıkın: HackerNoon Editörlerinden İçeriden İpuçları

Lên Trang nhất của Google với Mô tả Meta hiệu quả: Lời khuyên nội bộ từ Biên tập viên HackerNoon

利用有效的元描述登上 Google 首页：来自 HackerNoon 编辑的内部提示

Businesses today face the challenges of external threats, but internal threats are not left out either. An organization can suffer from dangers within; it could be through devious goals or carelessness. Insider threats can cause noticeable damage to the operation, finances, and reputation of a company. A Cybersecurity Insiders report reveals that 74% of companies are at least moderately vulnerable to insider threats. This piece analyzes practical steps to protect your business against these inward threats safeguarding an organization's security position and strength. Internal Threats Awareness Businesses need to be highly concerned about insider threats, as they exploit the security from within. Understanding insider threats is important as there is no one-size-fits-all definition of "insider threat," but rather several different forms in which it can manifest. Types of Insider Threats - Malicious Insiders: This is a threat that is caused by dishonest insiders who try to harm the organization on purpose by leaking confidential information, stealing data, infiltrating systems for their benefit, or causing extensive damage to the company. - Negligent Insiders: Careless insiders inadvertently harm as a subset of this type causes damage due to being unaware and faulty. They might manage sensitive data poorly, become prey to phishing scams, or simply fail to follow security procedures leading to unintended data breaches. - Compromised Insiders: These are valuable (and exploitable) employees whose credentials have been disclosed by predators on the web. Since the threat actors have already got their access to do potential damage, there is no need for a direct connection! Understanding Motives and Triggers Behind Insider Threats - Financial Gain: Your employees may even be tempted to sell sensitive information out of financial gains and other similar fraudulent activities. - Retaliation: Disgruntled employees who are unhappy in their employment, or perceive themselves as being treated unfairly might seek to retaliate. - Ideological Beliefs: An actor launches an insider attack as a result of ideological beliefs (e.g., to affect company X in order that it endorse position Y). - Lack of Awareness: Insiders who just do not know are a different matter, needless breaches caused simply by lack of awareness and training. - Outside Threat: Cyber criminals can blackmail or force employees to collude with them in their plans. Employees can be blackmailed or forced to assist cyber attackers with their malicious activities. Identifying Potential Insider Threats You need to be able to identify what these insider threats look like; this way, you can take the necessary steps to prevent them within your business. Here is how to spot the signs and make it right before it's too late. Insider threat-susceptible employees have various behavioral changes that raise flags. Look out for recurring arguments with co-workers, increased stress, and immediate financial issues accompanied by mysterious loyalty shifts. These behaviors might point to someone likely to be a threat due to external influences or personal problems. There are indications that the work may be facing a new threat. If you detect anything which may include logging in at odd hours of the day or using authorized devices as needed to access critical data, such irregular trends can help locate trouble before it even becomes a hurdle. Observation is key in the identification of insider threats. Using watchdog tools monitors the movement of files, emails, and odd activities. Maintaining employee confidentiality is key, but as long as monitoring practices are fair and transparent they can end up serving both the employees' mutual interests as well as those of the company. Operational data analytics and machine learning are advanced technologies that can search through a mass depository of data, allowing for the identification of anomalous activities above what any number of human observers could ever locate. Regularly training the models on new data is likely to make them more effective at identifying potential risks. Implementing Effective Security Policies To ensure the protection of sensitive data and continuity in business, establishing an effective security policy is essential. You can implement these policies efficiently through: 1. Creating a Sophisticated Insider Threat Detection Program Develop a comprehensive insider threat detection program. This has to do with monitoring the activities of employees by using advanced analytics to identify irregularities and set up alarms for suspicious activities. Being proactive will recognize threats before they cause danger. 2. Establishing Clear Policies and Procedures for Handling Sensitive Data It is important to have clear policies and methods for managing sensitive information. Specify what makes a piece of information sensitive and make rules for its entry, storage, and transfer. Ensure all employees understand these rules and the importance of complying with them. 3. The Importance of Background Checks and Vetting Processes Carrying out thorough checks and examination processes is important when it comes to cybersecurity for small businesses and big organizations too. Before hiring, perform a thorough background check, and verify the integrity and reliability of potential employees. Review these checks regularly to ensure continuous loyalty. 4. Regularly Updating and Enforcing Security Protocols Safety measures should be flexible, not static. Update your safety measures often to cater to new threats and vulnerabilities. A periodic training session should be conducted to keep employees updated on the latest security practices and ensure compliance with standard procedures. Employee Education and Training Consistent cybersecurity awareness training sessions keep employees updated on new threats and best practices to avoid them. These sessions should be very engaging and updated frequently to address new security challenges. Employees must understand why cybersecurity and data protection are vital. By highlighting the potential risks and impacts of data breaches, you can foster a sense of responsibility and vigilance among your staff. Encourage a sense of responsibility and caution among your employees by making employees understand the importance of data protection and cyber security, and also enlighten them on the consequences that come with cyber threats. Establishing a culture of security involves incorporating cybersecurity practices into day-to-day routine. There should be open discussions with employees about security and good practices, ensuring that everyone from the top to entry-level employees stays committed to maintaining a secure workspace. Technological Solutions to Mitigate Insider Threats Leveraging these advanced cybersecurity tools and software can help protect your business from cyber threats. 1. Utilizing Advanced Cybersecurity Tools and Software For identifying and getting rid of insider threats, advanced cybersecurity tools are integral to providing comprehensive protection by observing, identifying, and responding to questionable activities within your network. 2. Intrusion Detection Systems (IDS) IDS monitors network traffic for irregular activities and keeps you alert to potential insider threats. By finding anomalies, IDS facilitates fast response to prevent damage. 3. Data Loss Prevention (DLP) Solutions DLP solutions protect sensitive information from being accessed or shared inappropriately. It monitors data transfers and ensures that critical information remains secure, reducing the risk of insider threats. 4. User and Entity Behavior Analytics (UEBA) User and Entity Behavior Analytics tools examine the behavior of users and entities within your network. By establishing baseline behavior patterns, UEBA can detect deviations from normal behaviors that may indicate insider threats; this proactive approach allows you to address issues before they escalate. Response and Recovery Strategies Here’s a simple guide to developing effective response and recovery strategies for insider threats. 1. Developing an Incident Response Plan Creating a customized incident response plan specific to insider threats is essential. This plan should outline clear steps and assign roles to team members to ensure a swift and organized response. 2. Immediate Steps After Identifying an Insider Threat After detecting an insider threat, act fast; isolate affected systems, change access credentials, and begin an internal investigation. Quick action can prevent further damage and loss. 3. Communicating With Affected Parties In this situation, effective communication is very important. Bring it to the attention of both customers and employees and be transparent about the incident immediately. Addressing the issue without avoidance can help manage public relations and maintain trust. 4. Post-Incident Analysis and Future Defense After finding a solution to the incident, carry out a post-incident analysis to identify the root cause and security vulnerabilities. Use these insights to strengthen your defenses and update your incident response plan to protect your business in the future. Safeguarding Your Business From Insider Threats To ensure the security of your business from insider threats you need a proactive approach that should also be an adequate mix of tough policies, advanced technologies, and constant employee treason. Insight into the various forms of insider threats, combined with robustly executed security and a vigilant culture can significantly mitigate those risks. Be vigilant, prioritize security, and continually update your approaches to ensure that your business is well-protected inside as well as outside. Feature image source Businesses today face the challenges of external threats, but internal threats are not left out either. An organization can suffer from dangers within; it could be through devious goals or carelessness. Insider threats can cause noticeable damage to the operation, finances, and reputation of a company. A Cybersecurity Insiders report reveals that 74% of companies are at least moderately vulnerable to insider threats. This piece analyzes practical steps to protect your business against these inward threats safeguarding an organization's security position and strength. 74% of companies Internal Threats Awareness Businesses need to be highly concerned about insider threats, as they exploit the security from within. Understanding insider threats is important as there is no one-size-fits-all definition of "insider threat," but rather several different forms in which it can manifest. Types of Insider Threats - Malicious Insiders : This is a threat that is caused by dishonest insiders who try to harm the organization on purpose by leaking confidential information, stealing data, infiltrating systems for their benefit, or causing extensive damage to the company. - Malicious Insiders - Negligent Insiders : Careless insiders inadvertently harm as a subset of this type causes damage due to being unaware and faulty. They might manage sensitive data poorly, become prey to phishing scams, or simply fail to follow security procedures leading to unintended data breaches. - Negligent Insiders - Compromised Insiders : These are valuable (and exploitable) employees whose credentials have been disclosed by predators on the web. Since the threat actors have already got their access to do potential damage, there is no need for a direct connection! - Compromised Insiders Understanding Motives and Triggers Behind Insider Threats - Financial Gain : Your employees may even be tempted to sell sensitive information out of financial gains and other similar fraudulent activities. - Financial Gain - Retaliation: Disgruntled employees who are unhappy in their employment, or perceive themselves as being treated unfairly might seek to retaliate. - Retaliation: - Ideological Beliefs : An actor launches an insider attack as a result of ideological beliefs (e.g., to affect company X in order that it endorse position Y). - Ideological Beliefs - Lack of Awareness: Insiders who just do not know are a different matter, needless breaches caused simply by lack of awareness and training. - Lack of Awareness: - Outside Threat : Cyber criminals can blackmail or force employees to collude with them in their plans. Employees can be blackmailed or forced to assist cyber attackers with their malicious activities. - Outside Threat Identifying Potential Insider Threats Identifying Potential Insider Threats You need to be able to identify what these insider threats look like; this way, you can take the necessary steps to prevent them within your business. Here is how to spot the signs and make it right before it's too late. Insider threat-susceptible employees have various behavioral changes that raise flags. Look out for recurring arguments with co-workers, increased stress, and immediate financial issues accompanied by mysterious loyalty shifts. These behaviors might point to someone likely to be a threat due to external influences or personal problems. There are indications that the work may be facing a new threat. If you detect anything which may include logging in at odd hours of the day or using authorized devices as needed to access critical data, such irregular trends can help locate trouble before it even becomes a hurdle. Observation is key in the identification of insider threats. Using watchdog tools monitors the movement of files, emails, and odd activities. Maintaining employee confidentiality is key, but as long as monitoring practices are fair and transparent they can end up serving both the employees' mutual interests as well as those of the company. Operational data analytics and machine learning are advanced technologies that can search through a mass depository of data, allowing for the identification of anomalous activities above what any number of human observers could ever locate. Regularly training the models on new data is likely to make them more effective at identifying potential risks. Implementing Effective Security Policies To ensure the protection of sensitive data and continuity in business, establishing an effective security policy is essential. You can implement these policies efficiently through: 1. Creating a Sophisticated Insider Threat Detection Program Develop a comprehensive insider threat detection program. This has to do with monitoring the activities of employees by using advanced analytics to identify irregularities and set up alarms for suspicious activities. Being proactive will recognize threats before they cause danger. 2. Establishing Clear Policies and Procedures for Handling Sensitive Data It is important to have clear policies and methods for managing sensitive information. Specify what makes a piece of information sensitive and make rules for its entry, storage, and transfer. Ensure all employees understand these rules and the importance of complying with them. 3. The Importance of Background Checks and Vetting Processes Carrying out thorough checks and examination processes is important when it comes to cybersecurity for small businesses and big organizations too. Before hiring, perform a thorough background check, and verify the integrity and reliability of potential employees. Review these checks regularly to ensure continuous loyalty. cybersecurity for small businesses 4. Regularly Updating and Enforcing Security Protocols Safety measures should be flexible, not static. Update your safety measures often to cater to new threats and vulnerabilities. A periodic training session should be conducted to keep employees updated on the latest security practices and ensure compliance with standard procedures. Employee Education and Training Consistent cybersecurity awareness training sessions keep employees updated on new threats and best practices to avoid them. These sessions should be very engaging and updated frequently to address new security challenges. Employees must understand why cybersecurity and data protection are vital. By highlighting the potential risks and impacts of data breaches, you can foster a sense of responsibility and vigilance among your staff. Encourage a sense of responsibility and caution among your employees by making employees understand the importance of data protection and cyber security, and also enlighten them on the consequences that come with cyber threats. Establishing a culture of security involves incorporating cybersecurity practices into day-to-day routine. There should be open discussions with employees about security and good practices, ensuring that everyone from the top to entry-level employees stays committed to maintaining a secure workspace. Technological Solutions to Mitigate Insider Threats Leveraging these advanced cybersecurity tools and software can help protect your business from cyber threats. 1. Utilizing Advanced Cybersecurity Tools and Software For identifying and getting rid of insider threats, advanced cybersecurity tools are integral to providing comprehensive protection by observing, identifying, and responding to questionable activities within your network. 2. Intrusion Detection Systems (IDS) IDS monitors network traffic for irregular activities and keeps you alert to potential insider threats. By finding anomalies, IDS facilitates fast response to prevent damage. 3. Data Loss Prevention (DLP) Solutions DLP solutions protect sensitive information from being accessed or shared inappropriately. It monitors data transfers and ensures that critical information remains secure, reducing the risk of insider threats. 4. User and Entity Behavior Analytics (UEBA) User and Entity Behavior Analytics (UEBA) User and Entity Behavior Analytics tools examine the behavior of users and entities within your network. By establishing baseline behavior patterns, UEBA can detect deviations from normal behaviors that may indicate insider threats; this proactive approach allows you to address issues before they escalate. Response and Recovery Strategies Here’s a simple guide to developing effective response and recovery strategies for insider threats. 1. Developing an Incident Response Plan Creating a customized incident response plan specific to insider threats is essential. This plan should outline clear steps and assign roles to team members to ensure a swift and organized response. 2. Immediate Steps After Identifying an Insider Threat After detecting an insider threat, act fast; isolate affected systems, change access credentials, and begin an internal investigation. Quick action can prevent further damage and loss. 3. Communicating With Affected Parties In this situation, effective communication is very important. Bring it to the attention of both customers and employees and be transparent about the incident immediately. Addressing the issue without avoidance can help manage public relations and maintain trust. 4. Post-Incident Analysis and Future Defense After finding a solution to the incident, carry out a post-incident analysis to identify the root cause and security vulnerabilities. Use these insights to strengthen your defenses and update your incident response plan to protect your business in the future. Safeguarding Your Business From Insider Threats To ensure the security of your business from insider threats you need a proactive approach that should also be an adequate mix of tough policies, advanced technologies, and constant employee treason. Insight into the various forms of insider threats, combined with robustly executed security and a vigilant culture can significantly mitigate those risks. Be vigilant, prioritize security, and continually update your approaches to ensure that your business is well-protected inside as well as outside. Feature image source Feature image source source

How to Protect Your Business From Insider Threats

Insider threats are a problem as old as time. So, why are we still not so great at dealing with them? Or more to the point, why does the security industry not seem to be nearly as developed in its methodology when it comes to identifying these insiders? At least, in relation to how frameworks have been created for other areas of security. So, when MITRE’s Chief Scientist for Insider Threats Capabilities Dr. Deanna Caputo spoke about the launch of a new framework for insider threats in a , it brought up more than a few questions about where we are headed. recent interview Not Enough Is Known About Insider Threats Speaking to Dr. Caputo, the first point that stuck out was that this new framework was not replacing a previous one. It was the first of its kind to address a growing concern. Insider threats have been on the rise for a while. In 2023, the Verizon Data Breach Investigations Report (DBIR) found that insiders were responsible for 19% of incidents. But long before this report, in 2018, the team at MITRE received a request from a large financial organization to start compiling data about insider threats to create a framework that will help defenders do a better job of catching them. Dr. Caputo notes that there is plenty of research out there on insider threats, focused primarily on the technical or psychological components of the issue. But much of what we know about incidents is based on anecdotal cases and are not really data-driven. “We have great sensoring, meaning we can see everything you do on your computer,” she says, noting the expansion of tools available now for detecting risk factors being adopted by security teams. “But that doesn't mean we know what the risk or even the threat looks like. So we're finding them but kind of tripping over them when it’s too late. Instead, we want to find them before the big harm has been done. And the data is out there.” Unfortunately though, this data was not being collected and analyzed in a single project where it could be operationalized. This is where Dr. Caputo and her team understood that they could play a role in creating a framework that would look at the full range of risk factors and actions to provide security teams with a better approach to tackling the problem. After some delays from Covid, late last year Dr. Caputo’s team restarted their outreach to the industry to have them confidentially send in their confirmed insider threat incidents for them to study. This included both cases of malicious actors as well as those unintentional actions which could be classified as errors on the part of insiders. Addressing the Demand for a Framework From Insider Threat Professionals While collecting data for problem-solving is generally a good thing, the question of who exactly this framework is meant to serve was a bit puzzling. After all, we already have MITRE’s ATT&CK and D3FEND frameworks. So why are they making another one? Dr. Caputo answers that as the insider threat space matures, there is a need for a framework that organizations can use as a benchmark for how they are dealing with the challenges. “Executives are expecting them to see things but the problem is that the signs are not obvious enough,” she says. There is also a considerable need for direction when it comes to how to prioritize indicators in assessing insider threats. She points to the fact that many organizations now have a dedicated person whose role is specifically to handle insider threats as a positive development. This is important because it is not just individuals from infosec, the SOC, or HR she says, noting though, that this is a team sport. The idea is instead to have someone who sees the whole picture across every component of the threat picture and can really connect the dots. And that requires taking an approach that takes all the factors into account and questions some of our old assumptions about what an insider threat looks like. Taking a Holistic Approach to Insider Threats Along with the attempt to become a central repository for insider threat data, Dr. Caputo says that her team is looking to make this research different by collecting both the technical cyber data as well as many of the more human psychological factors. Catching insider threats is a fairly difficult endeavor. She makes the point that identifying the risk is not necessarily from any one action or even rule-breaking. Moreover, unlike a ransomware attack or terrorism, there is no “boom” moment where we know that the attack has occurred. A smart malicious actor will keep their head down and do what they need to in order to steal information over the long run without getting caught. If we are only looking at specific actions through our own silos of visibility, then we are probably going to miss significant signals. Part of the work means reassessing misconceptions. “We spend too much time on bad things happening in people's lives and we don't account for the risk that good things cause,” says Dr. Caputo. “Humans are never perfect and our judgment is degraded by a lot of things like lack of sleep, fatigue, stress, but stress is good and bad. So the stress of getting married, the stress of buying a house, the stress of having small children all have the equal impact on your decision making. Even though they're very happy things.” “I think programs are slowly starting to see that we're not just waiting for bad things that happen to our employees,” she says, explaining that, “We need just to account for their whole being, which might mean that good things are overwhelming them. And that sounds so odd. But it's true. It's not that something really bad happened and they decided to do bad things. It's just not that simple.” There is also the matter of perspective. Dr. Caputo uses the example of financial factors in insider threat activity. “It’s not about debt,” she says. “The number of insiders for small amounts of money is more about how much that money matters to them. It centers more on how much your debt matters to you and how much do you feel you need to have. Think about financial strain and stress when assessing who is likely to be recruited.” The challenge here though is in how to identify the likely recruits and their associated indicators. “We’ll find more about how to identify it in the framework,” she says. Where Organizations Are Getting it Right The good news says Dr. Caputo is that organizations are getting better at some aspects of the fight against insider threats. Funding for investing both in people and tools appears to be improving, says Dr. Caputo. While there is room for improvement in dealing with issues like false positives and knowing which indicators are the right ones, she says that organizations are doing much better at having more sensors out there for visibility and to collect relevant information. 3 Tips for Improving Your Insider Threat Program Along with the good movement that we are seeing, there is always an opportunity to improve. Dr. Caputo takes a human-centric approach and offers a couple of tips to consider. Don’t Treat Everyone as Negligent “There’s the misconception that if an employee makes a mistake, that's negligence, but that's not right”, says Dr. Caputo. “If we keep talking about them being negligent, all of our human sensors are going to stop caring, or trying.” If we want our employees to be part of a “human firewall” that helps by identifying issues and making the effort to do things right, then avoid treating them like anything less than human adults who will make mistakes here and there. “You have to expect errors and mistakes, genuine human mistakes,” she says. Attackers are Changing Behaviors So Don’t Shame “We get outsmarted a lot and our adversaries are constantly changing their human social engineering,” says Dr Caputo who has begun referring to new methods to trick humans as zero-day social engineering because it resonated with her technical people. Just as you would not shame a technical person for not catching a classic zero-day vulnerability, we need to cut our teams some slack when a clever attacker uses an innovative and new idea to get past our defenses. People Aren’t the Weakest Link, They’re the Missing Link Turning a misconception on its head, Dr. Caputo is a firm believer that your people are your strongest defense. Technology will only get us so far. Think about the phishing emails that make it past the filter as a prime example. When one does, how are we empowering our people to identify it and send it on to security? The same concept holds true for insider threats. Technology will help us pick up tons of valuable signals like exfiltration or accessing sensitive data, but it is often the human referrals of suspicious activity that will help us to fill in the whole picture and identify a threat. How to Get Involved in the Insider Threat Framework At this point, there is no set date for the framework's release. Dr. Caputo hopes that it might be available at the end of 2024, but says that it is a slow process. For now, the focus is on collecting quality data, relying on the early adopters to help them get to some findings. It will need time to improve as more organizations join them and share their data. Dr. Caputo hopes that more organizations will take part in the effort. “No amount of data is too little to participate in this,” she says, adding that, “This can’t be done without help from the community.” The benefits for those who share data is that they will get to see more of the findings sooner, learning more about themselves earlier, having an impact on the way that the framework is shaped. Insider threat leaders can advocate for sharing their data with MITRE, noting how combining efforts can help vendors and customers pool efforts for the community’s advancement in getting better at really understanding insider threat issues. “This gives a way to make more data-driven decisions,” she says. “Don’t underestimate the willingness to have different departments participate because they will see gains as well.”

MITRE Pushes to Launch New Insider Threat Framework

A published in late 2023 described how insiders were increasingly using privilege escalation exploits in order to carry out unauthorized actions on their organizations’ networks. report According to the report from Crowdstrike, 55% of identified insider threats used or attempted to use privilege escalation exploits. In cases where the insider was malicious, they were observed using their elevated privileges to use additional kits like Metasploit, Cobalt Strike, and other tools meant for exploiting systems. It is worth noting that the research was focused on on-prem systems and probably did not include data collected from abuse of cloud applications. Perusing through their report, the vast majority of the hits are on Windows and Linux systems. That said, within the given parameters, these are still some pretty significant findings that are worth paying attention to for security teams as we navigate 2024. It may indicate that insider threats are finding new innovative ways to attack core systems while circumventing important controls. Why Does Privilege Escalation Matter? If we do our jobs right, then we put controls in place defining what our people are able to do in terms of which systems or assets they can access. Diving a step deeper, we can control not only what can be accessed, but what someone can do with that asset. Can they read, write, edit, or delete an asset? Can they change privileges for themselves or others? The rabbit hole of privileges can spiral pretty far, but it can be really important for your data security. In the ideal world, every user has exactly the minimal level of access and privilege that they need to do their job. This is known as the Principle of Least Privilege. It is almost impossible to be perfect at getting this exactly right, but it is the goal to aim for. Where it gets tricky is when a user finds ways to escalate their privileges from what they have been provisioned. If they are successful, then they have broken out of the defined borders of what they are supposed to be able to do with our systems. We lose a level of control, and in the case of the insider threat actor, we face a difficult opponent who has deep knowledge of our assets and how to find them. Challenges Posed By Insider Threats Insider incidents have been steadily increasing over the past several years, and this trend is not expected to change in 2024. This is exceedingly concerning because insider threats in many ways pose many more difficulties than an external attacker. Beyond their negative impacts on an organization, undermining trust from customers, partners, and internal stakeholders, they can be downright difficult to detect. One of the challenges with an insider threat is that this user starts the game off with a set of privileges that allow them a foothold within the organization. On the face of it, this makes sense. If the person is an employee, then you need to give them the ability to do their job. This means accessing the appropriate systems and data to be an effective employee. The second challenge is that the employee’s movement within the organization’s systems will be viewed as normal and is unlikely to set off any warning bells unless they stray too far off the reservation. In practical terms, the chances are pretty low that the insider will touch one of your honeypots because they already know exactly what they want to access and where it is located. So given some of these challenges, we have here below a couple of tips for countering the privilege escalation threat from your insiders. 3 Strategies for Reducing Your Risk from Insider Threats Escalating Privileges Patch, Patch, and Be Sure to Patch Early and Often One of the longest standing pieces of advice when it comes to cyber security, even predating implementing multi-factor authentication (MFA), is the criticality of patching your software systems. While zero day vulnerabilities like those used to damage Iranian nuclear facilities or hack iPhones may get all of the press, most hackers use known vulnerabilities that are released to the public for carrying out their attacks successfully. Hackers come across these vulnerabilities usually in one of two ways. First is that they are able to look at the publicly available vulnerabilities (CVEs) that are published by the MITRE Corporation for the benefit of the public. Second, and more annoyingly, they can look at software updates and try to figure out what has been fixed, and then see how to exploit it. For these reasons and more, be sure to patch soon after the new versions become available. As part of the vulnerability reporting and publishing process, companies who own the software, or in the case of open source software the project managers, are usually given a period of 90 days to fix the problems in their products before the information becomes public. This balances between the need to push these software owners to action with the space they need to develop a fix for the bug. However, all of their hard work goes to naught if we do not use the patches that they issue. This means implementing the patches for CVEs, going through the necessities of Patch Tuesday, and generally making sure that our systems are up to date with the latest versions. Patching can be a huge pain, and no organization is really where they should be on it. Always a few legs behind, hoping that they have patched their most critical systems. The hope is that the move to the cloud will remove the responsibility for patching from the end users and push more of it over to the vendors providing the SaaS solutions. Note however that this is not the case when it comes to cloud infrastructure (IaaS) like AWS, Azure, and GCP, so your IT and Security teams will still need to be up and running to stay current on these systems for some time to come. Monitor for Anomalous Behavior If an insider, or someone pretending to be, manages to escalate their privileges to access different systems than they normally would, this should set off major flags. If you have the monitoring in place to catch it of course. Capturing a baseline of normal activity with User Behavior Analytics tools is a must for figuring out when suspicious behavior is afoot. The advantage here is that your monitoring of behavior runs in the background and is not going to be impacted by illicit changes to their privileges. The systems they touch or other actions that they take are going to be picked up, logged, and alerted upon if they stray from the confines of what you have defined as normal for them. Beyond the alerting feature, the other benefit of monitoring your environments is for use in investigations after an incident. One of the biggest challenges in incident response is understanding which systems were impacted and might need remediation. Having session recording of activity in sensitive systems tied to a specific user can cut the time spent on investigations significantly. Educate Your Workforce About Following the Rules Facebook’s Mark Zuckerberg popularized the idea of “Move fast and break things” as part of the startup ethos that drove companies to success. While breaking out of a stodgy corporate mindset can do a lot of good when it comes to innovation, there are some benefits to staying within at least some of the guidelines. Company policies about what kinds of software can be downloaded to the business’ machines and the processes for approval are there for a reason. Even a given policy seems like more of a hindrance than something that makes a whole lot of sense. The best way to get your people to follow your rules is less about sticks and more about getting them on board by explaining to them what the potential impact of rule breaking can lead to. Ideally avoid death by Powerpoint and make the sessions a little more interactive. One method that has proven to be more effective is to assign different cases of policies being broken and present to their group how it played out. This is the also same methodology used in the military for teaching life and death safety material and it really sticks in your memory. Unintentionally Reckless But Not Malicious Reading through the report, the news here is and is not as bad as it may seem. The authors note that 45% of the incidents do not appear to be caused by malicious insiders who intend to be threats. Some of the incidents involve insiders breaking the rules so that they can download software onto the organization’s machines that they are not supposed to, but for reasons other than harming their employer. Think about employees skirting around controls so that they can download torrents or other illicit software onto their work machines. Perhaps one of the greatest stories like this is the oldie and always goodie about the workers at a who connected their intentionally offline systems to the internet  for the purpose of mining cryptocurrency. This was before the outbreak of the war, but well into the campaign by Russian hackers targeting Ukrainian critical infrastructure, so it was still an exceptionally bad idea. Ukrainian nuclear power plant On the other hand, just because someone does not intend to cause harm does not mean that there is no foul. According to the , Miscellaneous Errors continue to comprise a significant chunk of the annual data breach statistics. And when it comes to regulators investigating companies for exposing controlled data like customer PII, they do not much care if the action was malicious or not. Just that it happened. Verizon Data Breach Investigations Report for 2023 Hopefully by following best practices and educating your team, you can avoid having to explain a bad incident off as a moment of bad judgment versus an act of bad faith altogether.

Insider Threats are Increasingly Using Privilege Escalation Exploits

অভ্যন্তরীণ হুমকি ক্রমবর্ধমানভাবে বিশেষাধিকার বৃদ্ধি শোষণ ব্যবহার করছে

Insider-Bedrohungen nutzen zunehmend Exploits zur Privilegieneskalation

Las amenazas internas utilizan cada vez más exploits de escalada de privilegios

Les menaces internes utilisent de plus en plus d’exploits d’escalade de privilèges

अंदरूनी धमकियां विशेषाधिकार वृद्धि के कारनामों का तेजी से उपयोग कर रही हैं

内部関係者の脅威は、権限昇格エクスプロイトを使用することが増えています

내부자 위협은 권한 상승 악용을 점점 더 많이 사용하고 있습니다.

Ameaças internas estão usando cada vez mais explorações de escalonamento de privilégios

Инсайдерские угрозы все чаще используют эксплойты для повышения привилегий

İçeriden Gelen Tehditler, Ayrıcalık Yükseltme Suiistimallerini Artarak Kullanıyor

Các mối đe dọa nội bộ đang ngày càng sử dụng các hoạt động khai thác leo thang đặc quyền

内部威胁越来越多地利用权限升级漏洞

In 2023, Tesla experienced its biggest insider threat of the year in May, announcing that it had suffered a massive data breach, marking what is possibly the biggest breach in the company’s history, with __ __and former employees having personally identifiable information (PII) leaked. over 75,000 employees According to the reports which dubbed the stolen data as “The Tesla Files”, the 100 GB leak included: Employees’ personal information like their names, addresses, phone numbers, and Social Security numbers Customer bank details Production secrets Customer complaints about Tesla’s Full Self-Driving (FSD) features Even CEO Elon Musk reportedly had his Social Security number leaked. We have since learned that there were two culprits behind the breach: who sent the massive data dump to the German newspaper Handelsblatt. two former Tesla employees The good news for Tesla is that the outlet has announced that they will not be publishing the contents of the leak. As a journalistic organization, especially in Germany, Handelsblatt could find itself in hot water for publishing peoples’ PII. However, the publisher did note the fact that the leaks included complaints about safety issues with the vehicles, which could still cause Tesla a fair amount of grief as writing about these issues could easily fall in the “public interest” bucket for journalists. The bad news is that the company may still be on the hook for in fines due to data privacy violations under GDPR. $3.3 billion While the leak is interesting in itself for reasons of scale and the high profile target, in this article, we are going to look at the role that fostering loyalty with employees can play in helping to tamper with the desire of employees to want to turn against their organizations. But first, let's take a look at Tesla’s history of dealing with insider threats. Tesla's History of Insider Threat Incidents This is not the first time that Tesla found itself in the headlines in terms of an insider threat incident. In fact, the company has a mixed bag when it comes to its history of insider threat incidents over the years. In 2018, Musk announced that a malicious employee had conducted " " to the company, exfiltrating large quantities of data and making changes to their systems. extensive and damaging sabotage The employee reportedly was angry over not receiving the promotion that they thought they thought was coming to them and decided to make their displeasure known through less than pleasant means. On the other side of the scale, in 2020, an employee alerted the company that he had been approached by an old acquaintance who tried to . Thanks to the employee’s warning, Tesla was able to thwart the attack, and the ransomware crew member was arrested. bribe him into helping carry out a ransomware attack In both cases, we see the potential damage a malicious insider can cause to their organization and frankly how easy it can be for them to be successful. Why are Insider Threats so Difficult to Stop? Insider threats are one of the hardest for organizations to defend against because they are legitimate users who are already inside your systems. Unlike outsiders who need to steal/phish/buy credentials and then defeat MFA, an insider is a real user inside your organization who can act totally normally until the moment that they do not.\ This means no indicators of compromise and no leaked credentials showing up on “Have I been Pwned.” You often will not detect it until the damage has been done. An additional factor is the fact that many insider threats are not actually malicious. While they cause real harm with their leaks, they act unintentionally through mistakes and general negligence. According to the Verizon Data Breach Investigations Report for 2023, was the cause of 98% of errors that led to a data breach. carelessness This difficulty in detection has led many organizations to look for ways to head off incidents before they happen, looking at strategies for prevention. This is where the question of motivation and loyalty comes into play. Negative Impactors on Employee Loyalty Year after year, the number one motivator for insider threat incidents is financial gain. You know, good old-fashioned greed. And yet, the seed that leads to the betrayal is planted long before an employee decides to take the more drastic steps of stealing or harming your data. Looking at the , researchers found that 89% of privilege misuse cases were financially motivated, followed by a “grudge” at 13%. Verizon Data Breach Investigations Report for 2023 So, what leads to that grudge? According to Jacques Y. Kassa’s 2021 thesis “ at the Naval Postgraduate School in Monterey, CA, depression, hopelessness, frustration, disgruntlement, and anger are all emotional factors that play into insider threats. ” Modeling the Relationship Between Loyalty and Insider Threat Not a groundbreaking insight but we also know that organizations do not invest enough effort in checking in with employees to see how they are feeling about their place in the organization. Kassa writes that motivators like ideology, vengeance, retribution, espionage, and activism are more frequent in government organizations than in the civilian sectors. Perhaps in the case of Tesla, there may have been a desire to share some of the safety data with the public, though there is a question of whether this is activism or retribution. There are, however, a couple of factors to watch out for. Underpaid and Underappreciated Being well compensated for your work is the top motivator for basically every employee. Better than extra snacks or company activities, employees need to feel that they are appreciated for their work, and commensurate compensation is a clear indicator of that recognition and respect. Feeling Part of the Team During the pandemic, one of the struggles faced by organizations was in employees maintaining a sense of being on the team. Going remote meant not strengthening the in-person, informal bonds that can make a person feel comradery with their co-workers and deter them from wanting to cause them harm. After all, if these are just people that you see on Zoom calls and email chains, what do you owe them if a better opportunity comes along? This has primarily been a problem for retention, but it can also impact motivations for someone turning malicious. Mass Layoffs and the Great Resignation We are at a cultural moment that is frankly different from where we were five or ten years ago. Uncertainty in the job market is a constant, with organizations laying off large quantities of workers in massive waves. Big players like Amazon have cut workers in the past year, while Microsoft has laid off over people. 27,000 10,000 This has led to the justified feeling among many that their companies are not loyal to them. So why should they show loyalty back? Why not take some customer data or valuable IP before you get shown the door if it might give you a leg up at your next job? Combine this uncertainty with the Great Resignation that saw workers leave jobs that they may have put up with for something better. Maybe they found a better location, something totally remote, or having other good conditions that they decided to seek greener pastures elsewhere. Many simply looked around and saw that plenty of others were leaving their jobs, so why not them, too? 3 Tips for Reducing Insider Threat Risk Given the ways that employee loyalty can be diminished, how can organizations improve the positive feelings that their employees have and reduce their risk of an insider threat incident? Here are a few suggestions. Provide an Outlet for Frustration or Concerns Beyond the need to feel appreciated, people need to feel that they have a place to turn to when something is bothering them at work. A question any company, especially a manufacturer, should ask is whether employees have a place to go where they can voice ethical concerns in-house and see that they are handled with due seriousness. If workers do not have an internal channel for dealing with concerns, then they may seek options elsewhere. Invest in Education and Training There’s an interesting question about when it comes to accidental insider-caused incidents. On the one hand, they do not actively choose to harm their employer since the case is unintentional. However, on the other hand, a lack of interest in following the guidelines due to a lack of a strong commitment to their organization probably plays a role in these incidents occurring. Dealing with the non-malicious actors requires fewer sticks and more carrots to get results. Training and education can play a critical role here in preventing incidents. The advantages here can be two-fold. Learning the proper protocols for handling sensitive data and systems teaches them how to do the job correctly and safely. It also gives them a sense of ownership. When your organization invests time and resources into training them how to be better at their job and protect the organization, then chances increase that they will try to implement what they learn in the courses. Encourage but Verify with User Behavioral Analytics Even as we work to increase the level of trust with employees, we need to implement measures to verify that folks are on their best behavior. This means putting in place User Behavioral Analytics tools for continuously monitoring behavior in order to establish a baseline of activity. Once we understand how people normally interact with the systems that they are entitled to work with and think about which applications, data sets, etc they interact with regularly, then we can detect when they begin to act anomalously. Most insider threat cases follow similar patterns in that they have threat actors abuse their privileges and find ways to exfiltrate their pilfered data. By monitoring sensitive files, we can see who is accessing them and potentially who is stepping outside the lines and needs to be followed up with. Loyalty is Earned, Not a Given One note for clarification. Companies are not families. They hire, fire, downsize, and work in their own self-interest. Most of us do not fire our family members, even if we want to sometimes. Employees have the same right to leave an organization if they feel that their own needs are not being met. Having loyalty to a company does not mean that someone should stay if they are not happy. What it does mean is that if the organization acts properly, then it will engender enough goodwill to keep employees on the ethical and legal path of not stealing their data or seeking to cause them harm. And that may count for enough to help diffuse and prevent a potential incident.

Data Breach: What Tesla’s Biggest Insider Threat in 2023 Can Teach Us Going Into 2024

ডেটা লঙ্ঘন: 2023 সালে টেসলার সবচেয়ে বড় অভ্যন্তরীণ হুমকি কী আমাদের 2024-এ যেতে শেখাতে পারে

Datenschutzverletzung: Was uns Teslas größte Insider-Bedrohung im Jahr 2023 für das Jahr 2024 lehren kann

Violación de datos: lo que la mayor amenaza interna de Tesla en 2023 puede enseñarnos de cara a 2024

Violation de données : ce que la plus grande menace interne de Tesla en 2023 peut nous apprendre à l’approche de 2024

डेटा उल्लंघन: 2023 में टेस्ला का सबसे बड़ा अंदरूनी खतरा हमें 2024 में क्या सिखा सकता है

データ侵害: 2023 年のテスラ最大のインサイダー脅威が 2024 年に向けて私たちに教えてくれること

데이터 침해: 2023년 Tesla의 가장 큰 내부자 위협이 2024년에 우리에게 가르쳐 줄 수 있는 것

Violação de dados: o que a maior ameaça interna da Tesla em 2023 pode nos ensinar em 2024

Утечка данных: чему нас может научить крупнейшая инсайдерская угроза Tesla в 2023 году в 2024 году

Veri İhlali: Tesla'nın 2023'teki En Büyük İçeriden Tehdidi, 2024'e Girerken Bize Ne Öğretebilir?

Vi phạm dữ liệu: Mối đe dọa nội bộ lớn nhất của Tesla vào năm 2023 có thể dạy chúng ta điều gì khi bước sang năm 2024

数据泄露：进入 2024 年，特斯拉 2023 年最大的内部威胁可以告诉我们什么

Nonprofit owners and managers must be as vigilant about protecting digital assets as the world’s most renowned tech companies. Financial institutions and health organizations have some of the highest concentrations of personally identifying information, but nonprofits are unsuspecting stores of Social Security numbers, banking information, and more. Insider threats are becoming more prevalent in the . How can nonprofits that require copious outside assistance keep data safe? digital threat landscape Unpacking Insider Threats The term “insider threats” is complex, primarily when nonprofit organizations have so many moving parts. Over threatened from the inside, meaning it should be a top priority for nonprofits whose mission is to improve the world. 90% of businesses feel They have permanent staff alongside a constantly rotating door of volunteers, sponsors, and business partners. Any one of these contributors may be an insider threat and compromise data with their access. Examples of inside threats include: Using fraudulent payment processing and accounting Working with threat actors to create vulnerabilities for cyberattacks Stealing donor or stakeholder information Selling data illegally to third parties Mismanaging fundraising funds with harmful intent Nonprofits to fraudulent activities like these. However, not all insider threats relate to digital resources, though they are some of the most common nowadays. Other insider threats include social engineering or manipulation of inside parties working for criminal outfits. These people can influence marketing, investing, and collaboration decisions for nonprofits. lose over 5% of revenue Nonprofits lose donor loyalty by ignoring the importance of protecting against insider threats. It has consequences on reputation and income. Most importantly, it impacts the charity’s mission when staff and supporters lose morale from compromised momentum. These strategies protect organizations on all sides from insider breaches. 1. Strict Volunteer Vetting Nonprofits rely on the kindness of volunteers to execute projects. Unfortunately, interest does not always signify good intentions. A desperate need for staff leads to people from every background having internal insights into the nonprofit. Most volunteers will work with honest intentions, but insider threats are too prevalent to provide blanket optimism. Vetting volunteers eliminates concerns because management can perform safety measures to ensure high-quality helpers. Nonprofits may interview, perform background checks, and review references to determine character quality. It provides because they have a strong sense of authenticity and trust. camaraderie between all volunteers 2. Limiting Permissions A case study of 20 nonprofit organizations revealed teams are too trusting. Around an overabundance of trust is the reason behind insider threats. Giving too many parties information and inadequate oversight are problems with simple remedies. Nonprofits must analyze this fact if they have yet to undergo digital transformation. 43% of participants stated Paper resources are more accessible for insider threats to tamper with or steal, and limiting who has access to business-critical information reduces the likelihood of theft. It also minimizes risk response because nonprofit managers will spend less time discovering the person or people behind the breach if only a small group of staff and volunteers have keys or passwords. 3. Developing Business Continuity Do nonprofit owners and managers have consistent documentation and plans that are easily accessible in case of an insider threat? Business continuity documents should be accessible to anyone detecting the insider threat. The plan must contain action steps for in a clear enough format that anyone can carry out the phases independently and notify relevant management. Here are some suggestions for what to include in a continuity plan in case of an insider threat: managing and reporting the threat Phone numbers and links for police Who to notify in information technology in the event of a digital breach Who to tell in management to contain the threat Shutdown actions, such as deactivating Wi-Fi, locking doors, or freezing company financial assets Executing digital backup recovery measures What evidence to gather Nonprofits are responsible for practicing and fine-tuning the continuity plans as new insider threats become more severe. Oversight must stay in touch with current events and trends in the sector to know what to protect against. Action must be proactive instead of reactive to have the most significant effectiveness. The plan must receive scheduled attention annually for reevaluation with advice from a fraud professional. The document should be thorough yet efficient because the last obstacle a nonprofit needs during a crisis is a too-laborious procedure for isolating the threat. 4. Establishing Culture Every previously mentioned action culminates into a nonprofit culture that opposes insider threats. The more a group works to establish that precedent, the more it reduces a threat actor’s willingness to work toward a breach. Creating safeguards and being transparent to donors and staff increases awareness of what the nonprofit is doing to protect its resources and people. Why would threat actors be motivated to target an organization with more robust security than another? Another way to establish a is to view protective measures as positive instead of preventive. For example, nonprofit organizations giving tours to new volunteers can point out their state-of-the-art security cameras and note which locations and documents are off-limits. Doing so outlines they do this out of safety for their staff, donors, and mission instead of out of fear or susceptibility to insider threats. positive culture that fights insider threats The more aware everyone is of these anti-insider threat details, the more likely workers are to report suspicious activity or challenge questionable language or actions from other stakeholders. Minimizing complacency and empowering staff members with confidence and agency increases the likelihood they expose insider threats. Even if they do not turn out to be legitimate, it diversifies a person’s view on what a threat could look like and how nonprofit managers can reduce false positives in the future. Guarding Against Insider Threats in Nonprofits Social good projects will only increase in influence as time goes on. More people will donate their time and money to causes to improve the world. However, this puts any relinquished data in a potential threat actor’s hands. Nonprofits are a great place for cybercriminals to gather data. Charities can set precedents that the sector is well-protected by using these strategies to deter malicious activity.

Digital Asset Protection: The Risk of Insider Threats for Nonprofits And What Can Be Done

The annual is a much-anticipated event every year for the cybersecurity sector. Verizon Data Breach Investigation Report Chocked full of comprehensive data about what happened in the past year and where we are headed, this report is the gold standard for taking the temperature of how we are doing when it comes to keeping our data safe. Among its areas of focus is some solid reporting on the state of insider threats. While the vast majority (83%) of breaches are caused by external actors (ie. hackers), a sizable 19% of incidents are from internal threat actors. The report defines them as anyone who has been granted access to company resources, be they full time, part time, or contractors. They are different though from say partners (read 3rd party) like vendors or others in your supply chain because those folks are a whole other kettle of fish. In some cases, the insider threat actors cause us harm by making honest yet costly mistakes. They might misconfigure some settings or send sensitive information to the wrong person. It happens. Their hearts might be in the right place even if their good sense might’ve skipped out for a stroll. But then there are those malicious insiders who intentionally cause harm, stealing, destroying, and generally being up to no good. These are people who were given trust and end up betraying it. But why? To figure it out, let’s take a look at the report’s findings on motivations for these bad internal actors, and see how it impacts various industries. Motivation Breakdown for Insider Threat Activities They say that the only certainties in life are death and taxes. Well, add the reported motivators for insider threats to this list. Unsurprisingly, financial motivation tops the list at a whopping 89%. This makes good sense as usual since most people do what they do for money. They see an opportunity to take something that they should not, and abuse the trust that was put in them. Our winner is followed up by: Grudge (13%) Espionage (5%) Convenience (3%) Fun (3%) Ideology (2%) While math was never my strong suit, even this writer can tell you that these motive results come out to more than 100. What it says is something perhaps more important. Malicious insiders are people who can have multiple motivations in their head at the same time. Take for instance a disgruntled hospital employee who hates her boss, got a bad deal from management, and has access to credit card numbers that she can sell via her cousin. As we dive into the different industries covered in the research, we see that motivations can clearly vary. Espionage is more likely to pop up in government or technology cases than say impacting SMBs at a more modest 7%. Let’s run through them and see what we can learn. Healthcare Threat Actors: Internal 35% vs External 66% Motivations: Financial 98%, Espionage 2%, Fun 1%, Ideology 1% Healthcare comprises a lot of people with a lot of access to sensitive information. It is notoriously hard to defend because most of these people legitimately need to be able to interact with patient data. While the motivation in healthcare related breaches fits the usual pattern of having financial at the top, the report points out that many of the data exposures are actually employees looking at data that they should not simply because they were curious about it. No intention to profit from it, but the organization can still be hit with a regulatory fine nonetheless. Health is a fascinating area for spies as well. This is because it can provide valuable insights into how a country is preparing for a future crisis, or for research on a new vaccine that another country can use to help out their own researchers. While grudges are not listed here as a motivating factor, it probably should be. Healthcare is a field with a lot of people under a lot of stress, working under tough conditions, so it follows that some may succumb to the pressure. Financial and Insurance Threat Actors: Internal 34% vs External 66% Motivations: Financial 97%, Espionage 3%, Ideology 1%, Convenience 1% At first glance, this sector has the highest internal actor percentage of the categories under review. This is maybe not totally surprising since employees may see an opportunity to help themselves to valuables if they think that they can get away with it. There is always the old joke about bank robbers robbing banks because that’s where the money is. But reading a little more into the report, this figure is a little misleading. They cite that misdelivery is actually one of the biggest issues when it comes to insiders. There is not a precise breakdown of how much is intentional vs mistakes, but it is a good reminder that we need to monitor our data handling with care. Government Threat Actors: Internal 30% vs External 80% Motivations: Financial 68%, Espionage 30%, Ideology 2% Government is an interesting sector to target for a number of reasons. First and foremost, government workers have plenty of access to information. Addresses, payment card details, and plenty more bits of sensitive data worth stealing, so there is more than enough motivation for a criminal actor. But then there are the spies. For obvious reasons, governments spy on each other. Rarely is it the case that James Bond breaks into the government installation and steals the secret plans. In the real world, case officers recruit insiders to become traitors, either with financial or ideological means. In some rare cases, you get a Reality Winner who makes mistakes and steals information that she then passes on to amateurs like The Intercept who expose her to the feds. By all accounts, she was hoping to influence public opinion and policy with her leaks, though not very effectively. Interestingly, government is a sector where we see a fair amount of collaboration between internal and external actors. Apparently in 16% of cases, there were bad actors working on both sides of your so-called perimeter. This is up from the 2% of cases back in 2020, so it will be interesting to see why this trend is rising. A Word for the Miscellaneous Errors and Partners in Crime By all accounts, the category of data breaches caused by Miscellaneous Errors, aka someone doing something unintentionally bad that exposes data, has continued its decline. It now only comprises 13% of the incidents. Whether it is better practices, or more likely technology as organizations have upgraded to cloud technologies, this is good news. The one area where it appears to still be cited as an issue is in healthcare, though the reason stated is mostly to do with misdelivery where data is sent to or shared with the wrong people. Apparently in 7% of cases, the attacks are carried out by the combination of internal and external actors working together to your detriment. They give the example of criminals who get themselves hired at the target company and then help their compatriots from the inside. Regardless of the motivations, your organization still needs to protect yourselves from risky insiders. Below are a few ways to get started. 3 Tips and Tools for Defending Against Insider Threats Insiders are always going to be harder to defend against because they are already inside your organization, and chances are they already know where to find what they want to steal. There are a few measures though that we can take to try and prevent their actions and detect them when they do occur. Implement User Behavior Analytics to Detect Sketchy Activity Gaining a baseline understanding of how a user acts within your systems is the first step in being able to detect when something is going wrong. By continuously monitoring what an employee is accessing, sending, editing, etc, big changes that may be indicative of malicious behavior can throw up red flags. For example, if an employee is interacting with sensitive files that are outside of their purview for their job, then it may be a good idea to give them a little bit of extra scrutiny. Add to this behaviors like working at off hours when their activity might otherwise draw less attention, and you can start to build a clearer picture of a potential employee threat. Limit Physical Data Transfers Some of the biggest data thefts in history were not carried out by hackers a continent away. They simply walked out the front door. Edward Snowden, Chelsea Manning, and more than a few other well-known names transferred files onto hard disks or even CDs. Use solutions to stop users from being able to move sensitive files over to physical devices like USB sticks, external hard drives, and the like. In the cloud era with its much more granular controls, there is simply no justification for needing to so given the potential risks. If all else fails, fill the USB slots up with gum. Block File Transfer Services In a similar vein to controlling transfers to physical devices, it is time to end the practice of allowing employees to use file transfer services. Services like Box, Dropbox, and others are great tools if they are being managed by your IT team. But allowing employees to connect their own file transfer accounts is just downright risky shadow IT. Block access to these services by setting rules in your monitoring software platform and encourage your team to use organizationally controlled services like SharePoint or better yet, Google Drive. Trust But Verify As we have noted previously, insider attacks are hard to stop because these are trusted people inside your organization. As scary as an insider threat can be, please remember that the vast majority of your people do not want to do you wrong. They may make mistakes because they are humans, but they mean the best. And the fact is that if we want them to keep doing their best, we have to give them respect and trust. By providing active monitoring to pick up on irregularities that may indicate a threat, we can implement the security controls we need to protect our data without being draconian or disrespectful. Because treating your people like a bunch of criminals is how you get them to act like thieves. Be respectful and hopefully you will get the same treatment in return.

Verizon Data Breach Investigation Report 2023 on Motivations for Insider Threat Actors

In April, many of us quickly became aware of the name Jack Teixeria. He made headlines as the 21-year-old Massachusetts Air National Guardsman suspected of leaking intelligence documents online to a forum of internet denizens via a Discord server that centered around what the described as “a shared love of guns, racist online memes and video games.” New York Times In case you missed the details of the story, Teixeria is suspected of having posted sensitive files containing American intelligence assessments on a range of topics, prominently among them -  tactical offensive plans in Ukraine.  This leak is being called the biggest blow to the U.S. intelligence community since Edward Snowden and has served to undermine trust with those entrusted to keep classified information secure. By all accounts from what we know so far, this is a weird yet painfully accurate picture of the modern insider threat. Let’s take a look at what we can learn from this story and the steps we can take to reduce our own risk of such a threat impacting our own organizations in the future. A Weird and Pointless Leak Usually when we think about government leakers, they fall into two categories based on their motivations. The first are the ones that do it for the money. These are your and types. Robert Hanssen Aldrich Ames Hanssen was a particularly fascinating yet damaging case to the not only because the information that he passed on to the Russians allowed them to uncover American human intelligence assets there, but also because he was part of the counterintelligence team that was tasked with hunting down spies itself. His inside knowledge and wide access to sensitive information made him one of the most destructive cases of espionage in U.S. history. The vast majority of insiders in any kind of organization, government or private sector, are motivated by how they can leverage their insider knowledge for their own benefit. The second type of insider threat is the ideologically motivated leaker like Edward Snowden and Chelsea Manning. Their disagreements, whether through conscientious objection or arrogance we will never know what was truly in their hearts, brought them to abuse their authorized access and steal information that embarrassed the U.S. government and may have compromised ongoing operations. But then we come to the soon to be retired Airman Teixeria. The 21-year-old IT specialist in the National Guard was looked up to by the teens and young guys of the Thug Shaker Central Discord server. reportedly Obstentably spun up for talking about video games, this server became a small community of immature, racist, and gun obsessed juveniles. Teixeria appears to have gained a reputation in the group, impressing the kids with his knowledge of guns and geopolitics. Apparently his antics on the forum was not enough to maintain his online version of “street cred”, so he began sharing highly classified information in the group. He started off with a few docs here and there. But when he did not get a sufficient dopamine hit of attention from his gaggle of devotees, he upped the ante and started flooding the forum with a tranche of classified material, telling them not to share it externally. So of course the documents leaked out to Minecraft chat groups, Telegram, 4Chan, and eventually Twitter. When the feds finally caught wind that they had a serious breach, it appears that they made fast work of finding the leaker, getting billing information from Discord and Teixeria’s first name and that he was in the Massachusetts Air National Guard from his chatroom followers. Additionally, he apparently also in the government intelligence system that he had access to, adding a final cherry on top for the list of things not to do when leaking classified information. searched for “leak” Teixeria for his part does not appear to have expected any kind of compensation for his leaking. His reported politics point to a reactionary with some feelings on Waco and Ruby Ridge, but there are no indications that his leaking was driven by politics. In the still early days of the investigation following his arrest for retaining secret documents without authorization, all signs point to Teixeria just wanting to show off to his friends. Video Games and Social Media a Target for Espionage Funny enough, this is not the first time that classified documents have been shared in video game forums. In 2021 the manual for the was posted to a page for enthusiasts of the tank game War Thunder. This was a repeat of when the specs for the British Challenger tank was also posted to the chat for the game. French main battle tank Apparently, the posters were fighting over the accuracy of the specs in the game and wanted to go to the source to prove their point. Some people will really go to that next step to win an argument on the internet. Global have picked up on the opportunity to glean information from these forums, as well as social platforms in general. A fact that the government is painfully aware of but has not yet taken sufficient steps to mitigate the risk from. intelligence agencies Thankfully, there are some steps that you can take to limit the damage from an insider threat. 3 Steps for Reducing Risk from an Insider Threat The list of “should haves” is going to be long following this investigation. Some of their findings are likely to be relevant for the wider public, but here are a couple of steps that you can take for your org. Monitor User Behavior to Detect Suspicious Activity There’s no reason why a single person should have had access to all the information that Teixeria did. Alarm bells should have started going off when he touched all of those files. Some of the damage could have been limited by properly segmenting the data. As an IT specialist, not necessarily an intel guy if the reporting is correct, then monitoring of his opening files from a wide range of topics should have sent alerts to the security team. This is if they were monitoring his user’s behavior with the right sort of tools. User Behavior Analytics (UBA) tools can help to establish the baseline of normal behavior and then alert when it deviates from the expected behavior. It does not have to interfere with someone’s ability to access data, but allows you to maintain security surveillance and control. Log Activity in Sensitive Data and Systems Being able to investigate who is behind a leak means connecting a lot of dots. By knowing who did what, where, and when, you can triangulate who is the likely culprit and understand the full extent of everything that was impacted. We saw in the reporting how investigators were able to see what Teixeria was searching for in their systems. Now that they have their man, they are probably going through his logs to see what he accessed to understand what else may have been compromised. Limit Data Portability Make sure that it is hard for someone to steal your sensitive data. While this takes some threat modeling to understand what your most sensitive assets are, you need to have the ability to simply block certain kinds of data from being sendable over cloud services, email, chat, and even by downloading them onto an external drive. This includes sending documents to printers so that they can simply walk out the door in somebody’s backpack. There can be agility tradeoffs here, but this can help to frustrate the exfiltration efforts of your would-be insider. Trust But Verify One of the biggest challenges that many seem to be working through following this story is the fact that in order for our organizations to function, we need to trust a lot of people to act with propriety. Reality is that not everyone is trustworthy, and there is a limit to your control over their loyalty. Treat people with respect, educate them about the rules and best practices, but at some point they have their own agency. Experts often refer to the “Clerk Problem” where the organization is always going to need some number of lower level people to actually manage the sensitive assets and data that they have. These individuals will generally be given access above their pay grade because there isn’t much of an alternative from a functionality perspective. Militaries will continue to rely on 19 year-olds, and our organizations will have to find innovative ways to ensure data security. Taking on this challenge successfully will require practices like continuous monitoring and being able to raise the red flag for investigators when one of our insiders takes a turn for the malicious, or in some cases, the moronic.

Insider Threats Among Us: Looking Back at Lessons Learned from the Discord Intelligence Leaks

There is a mole working its way into organizations across the world, collecting information and solidifying its position amongst the workforce. And employees and employers seem to love it. ChatGPT has burst onto the scene in the past few months, exciting many with its ability to write mediocre yet passable texts, and produce conversational search results. While still in its early days, interest is growing around how it can help save time, allowing its users to focus on the higher level of thinking that is still the realm of the human brain. For organizations, ChatGPT and its competitors offer automation for rote tasks and can have a big role in giving them a competitive advantage when it comes to productivity. But like every other technology, from fire to the internet, even the most useful of tools have the potential to burn us if we are not careful. A growing number of companies, from to Samsung, are banning their employees from using generative AI tools like ChatGPT to reduce their risk of sensitive data leaking out. However, given the pressure to embrace these tools, bans seem untenable. Apple to JP Morgan So for organizations that take security seriously but don’t have their own SCIFs, we will have to find ways of working with it securely. To get a handle on the challenges facing organizations that are continuously on the hunt for the next emerging threat - from insider risks within segmented networks to how new technologies can find exploitive ways to work from the inside, companies need to take a closer look at what this new technology is, what the risks are, and the steps we can take to reduce our risk. How do Generative Chatbots Work? Different machine-learning models have been in the works for a while now. But for the most part, they have been behind the scenes. Machine learning, deep learning, neural networks, et al, they all collect a lot of big data and produce results that we hope are helpful. One of the big advances in machine learning that has helped to make it more useful for the public is in the field of Natural Language Processing (NLP). NLP is what allows users to interact with the AI speaking as a person would, improving the experience for both the ease of asking questions and for the quality of the responses. These AIs (an imperfect if widely recognized term) scrape data from across the web and produce synthetic answers. If you have not yet tried them out, go ahead and play with them a little bit. You’ll either fall into a rabbit hole or get bored after about 15 minutes. The scraping and processing of information is far from a static process. These AIs are constantly learning from users, both in the interactions to improve quality, but also from the input that users give back to them. All that data gets stored in the data lakes and then turned into new outputs. This is fine for general information, helping people quickly learn from publicly available information to find the answers to their questions. However, it is when more sensitive data gets thrown into the mix that we start to see issues arise. Generative AI as an Insider Threat Employees used to asking ChatGPT questions may that can harm the organization. Not because they mean to cause harm to their employers, but because they were unaware of the risks. inadvertently leak information At this point, it should be fairly obvious that one should not upload your product’s source code to GitHub or sensitive information to social media. Right? Right? What is less clear is about inputting data into a tool online. After all, they upload data to O365 or other commercial software all the time. They also do queries on Google, and that’s normally ok. So what’s the big deal? Workers have access to a wide range of information. Some of it is fairly privileged and needs to be handled with extra care. Some of this may be strategic data about plans for the coming year. In other instances, intellectual property like chip designs might end up in the data sets that generative chatbots are using to learn off of. If the data becomes usable for learning and queries, then someone else may be able to pull that information out later as well. We are already where people are putting company plans into ChatGPT to tell it to turn them into presentations. It is not hard to believe that workers will use client information to compose emails, saving time but likely breaking all kinds of regulations and raising their risk of exposure. hearing about cases 3 Tips for More Secure Use of Generative AI From what we see at this point, most people are acting responsibly with their generative AI tools, so the situation may not be as dire as it could be. That said, it is always better to prepare for risks early. Here are a few tips for getting ahead of the challenges. Create and Explain Policies for Use Lay out a clear policy of what is and is not allowed to go into ChatGPT. Chances are that most folks will have the common sense to know that you do not put anything sensitive into a system you do not control. However, we need to assume that plenty of people do not fully understand how these technologies work and that they are at risk of causing potential harm. Remind them that data like: Intellectual property Client information Company financials Should not be put into ChatGPT under any circumstances. As a general rule, it is good policy to lay out expectations for security policies and explain why they matter. You will find that you can get significantly better buy-in from team members when you speak to them like adults and provide them with some context. Monitor the Use of Chatbots Organizations need to monitor what their employees are inputting into generative AIs. They can do this by using application monitoring tools, either selectively or more broadly, depending on their threat modeling. This is a similar use case to how User Behavior Analytics are utilized to monitor browser use or uploading of information to chat, email, file transfer, or other apps that pose a risk of leakage. Monitor Sensitive Data and Apps Monitor logs of access to sensitive data to create a trail in case you discover that your IP or other controlled data ends up being exposed. This is important both for your own ability to go back and do incident response as well as a reminder to employees that they are accountable for their actions. Still Early Days We are only really in the early stages of the usage of generative AI. Culture and awareness of how to use new tools and technologies take time to develop, so our expectations with ChatGPT et al will have to align with reality. Right now, these tools are somewhere between productivity hacks and total gimmicks. It is hard to properly assess the risk level we face here at this point, so some companies are choosing to put the brakes on its use until they can establish effective policies. This approach can only hold for so long until the levees break and demand for more integrations of AI products force organizations to let them in. Now is the time to get a head start on preparing your workforce on how to use these technologies securely, developing a culture of responsible use and accountability. As to where we go next, go ask ChatGPT for the answer.

Stories, News & Mentions about INSIDER

Categories

Trending Topics

Stories, News & Mentions about INSIDER

Insider’s Stories on HackerNoon

Insider's News & Mentions

Categories

Trending Topics