September EventSource Newsletter
By Jagat Shah, CTO, Prism Microsystems
originally published in Help Net Security Magazine
The threat within: Protecting information assets from well-meaning employees
Most information security experts will agree that employees form the weakest link when it comes to corporate information security. Malicious insiders aside, well-intentioned employees bear responsibility for a large number of breaches today. Whether it’s a phishing scam, a lost USB or mobile device that bears sensitive data, a social engineering attack or downloading unauthorized software, unsophisticated but otherwise well-meaning insiders have the potential of unknowingly opening company networks to costly attacks.
These types of internal threats can be particularly hard to detect especially if a company has placed most of its efforts on shoring up external security. For instance, some cyber gangs in Eastern Europe have come up with a pretty clever method to swindle money from small US companies. They send targeted Phishing emails to the company’s treasurer that contains a link which, when opened, installs malicious software that harvests account passwords. Using this information, the criminals initiate wire transfers in small enough amounts to avoid triggering anti money laundering procedures. In cases like these, traditional defenses (firewalls, anti-virus etc) prove to be useless as legitimate accounts are used to commit fraud. This story is not uncommon. In a study conducted by Ponemon Institute earlier this year, it was found that over 88% of data breaches were caused by employee based negligence. In another survey of over 400 business technology professionals by Information Week Analytics, a majority of respondents stated that locking down inside nodes was just as vital as perimeter security.
Employees, the weakest link
Let’s take a look at some of the easy ways that employees can compromise a company’s confidential data without really meaning to.
Social engineering attacks – In its basic form, this refers to hackers manipulating employees out of their usernames and passwords to get access to confidential data. They typically do this by tracking down detailed information that can be used to gain the trust of the employee. With the growing popularity of social networking sites, and the amount of seemingly innocent data that a typical employee shares on these sites, this information is not hard to track down for the resourceful hacker. Email addresses, job titles, work-related discussions, nicknames, all can provide valuable information to launch targeted phishing attacks or trick emails that lead an unsuspecting employee to hand over account information to a hacker posing as a trusted resource. Once the account information has been obtained hackers can penetrate perimeter defense systems. Read more
SANS interviews Ananth, CEO of Prism Microsystems, as part of their Security Thought Leader program
Ananth talks with Stephen Northcutt of SANS about trends in Log Management/SIEM, cloud computing, and the “shallow-root” problem of current SIEM solutions
Court allows suit against bank for lax security
In a ruling issued last month, the District Court for the Northern District of Illinois, denied a request by Citizens Financial Bank to dismiss a negligence claim brought against it by Marsha and Michael Shames-Yeakel. The Crown Point, Ind. couple — customers of the bank — alleged that Citizens’ failure to implement up-to-date user authentication measures resulted in the theft of more than $26,000 from their home equity line of credit.
HITECH Act ramps up HIPAA compliance requirements
The American Recovery and Reinvestment Act of 2009 (ARRA) includes a section that expands the reach of the Health Insurance Portability and Accountability Act (HIPAA) and introduces the first federally mandated data breach notification requirement.
Note: While this article is a few months old, it is a must-read. In particular, the part about (stiffer) penalties being funneled back into the Department of Health and Human Services’. HIPAA has essentially been a toothless tiger, this could be a sign that it is getting new teeth.
Former IT Specialist Hacks into Charity’s Network
A computer specialist has been arrested and indicted for breaking into his former employer’s computer network one year after he was let go. The admin is accused of causing significant damage by deleting records and crippling critical communication systems such as email and telephone.
Did you know? EventTracker offers advanced protection from insider threats, whether it’s a malicious employee or ex-employee looking to steal confidential data or an unsophisticated employee that accidentally causes a breach
Attackers target Microsoft IIS; new SMB flaw discovered
Microsoft updated an advisory, warning customers that attacks have been detected against a zero-day flaw affecting its FTP Service in Microsoft Internet Information Services (IIS). Meanwhile, new exploit code surfaced last weekend, targeting a zero-day vulnerability in Microsoft Server Message Block (SMB).
Did you know? EventTracker’s integrated file integrity and registry monitoring module detects Zero-day attacks that evade signature based solutions such as antivirus.