Slashdot Mirror
Insider Threats Pose the Biggest Security Risk (betanews.com)
An anonymous reader shares a report: According to a new study 91 percent of IT and security professionals feel vulnerable to insider threats, and 75 percent believe the biggest risks lie in cloud applications like popular file storage and email solutions including Google Drive, Gmail and Dropbox. The report from SaaS operations management specialist BetterCloud also shows 62 percent of respondents believe the biggest security threat comes from the well-meaning but negligent end user.
Among other findings are that 46 percent of IT leaders (heads of IT and above) believe that the rise of SaaS applications makes them the most vulnerable. In addition 40 percent of respondents believe they are most vulnerable to exposure of confidential business information such as financial information and customer lists. Only 26 percent of C-level executives say they've invested enough to mitigate the risk of insider threats, compared to 44 percent of IT managers.
Among other findings are that 46 percent of IT leaders (heads of IT and above) believe that the rise of SaaS applications makes them the most vulnerable. In addition 40 percent of respondents believe they are most vulnerable to exposure of confidential business information such as financial information and customer lists. Only 26 percent of C-level executives say they've invested enough to mitigate the risk of insider threats, compared to 44 percent of IT managers.
would be reposts of the same news sometimes on the same day.
Except now employees do it for political reasons. For example, the IRS employee who decided to give Michael Cohen's financial info to journalists.
Any private messages on Facebook, Google, or Twitter owned services are liable to be published at any moment by politically involved personnel.
And we just learned that Facebook was keeping millions of user passwords in plain text ;)
Yep. So....do we get all that taxpayer money back spent on lawyers and special counsel to find out that nothing happened?
Nope.
Schiff can suck my dick.
Employee loyalty is getting lower all the time thanks to crap pay and terrible working conditions.
Right now, American companies are putting on the newest version of Windows, and yet, they are getting cracked more often. Why?
Is it because Windows is worse? No. Windows is actually getting more secured.
So, are the Russians simply moving to America and cracking it here? No. If that was the case, then we would be arresting MORE, not fewer Russians.
So, how are the Russians getting into many of our Business computers?
What has businesses increasingly done? OUTSOURCED. Who to? India and China. We do not hear of India cracking our systems, but China has increased it.
BUT, how does one of these connected with Russians cracking American businesses? Simple. Who is India's best friend in the military? It is not the west. It is Russia. Many many Indians are employed by Russian defense companies and then go work on western, esp. American businesses. And those Indians are then paid around $10-20K, while we fat Americans are paid 100+K. So, if a Russian approaches an Indian friend of his and says, "look, we will pay you $150K just to leave a back door in code.", what do you think that he will say?
Yeah, getting paid 10x your yearly tends to make ppl jump esp when it does not harm their family, nation, etc..
As to the Chinese? Well, we employ them here and we outsource there as well. What do you expect.
The west deserves what it is getting because we refuse to acknowledge what is happening. We will allow political correctness to control us. Fools.
I prefer the "u" in honour as it seems to be missing these days.
with a photocopier and give it to the media.
to a USB stick and walk out with data for political reasons.
The well-meaning worker who hands your documents/data to a waiting journalist?
Who collected data on the crimes of the company, a side of politics, brand, gov, NGO, movie studio, bank, mil they work for and tells the world.
Want security?
Is the person who they say their are. Fake ID? Sharing an ID? Not a citizen? No security clearance found but they present as having a gov/mil past and a security clearance?
Dont hire people with a past that is fictional and created.
Investigate your staff. Their background in education. Their ability to learn. Their use on non academic considerations to get an education.
Could they pass their exams at every stage of their education?
Who they are friends with. Their friends politics. Are their friends criminals? What their hobbies are. Any lifestyle problems that are beyond their wage? Gambling? In debt? What do they read, watch, publish?
Addiction that cost more than their wage? Health problems? Medical issues not covered by their wage and health insurance? An alcohol problem? Found faith? Looking for faith?
Have they worked in a trusted setting before? Did they report problems? Talk to journalists? Create problems in past jobs?
A split loyalty to another nation, faith, cult? Getting work in your nation to spy for anther nation over decades?
A change in online political views to become an activist? Talking to and seeking out journalist? Discovered looking up advice on accountability and whistleblower laws?
Meeting with journalists? Got a new lawyer who has a security clearance and who works with whistleblowers?
Mitigate the risks by hiring on merit and doing a full background investigation.
Then give your new staff some fictional project. See who is tempted to walk to the media with fake project documents.
See who made a copy. Who transferred out a copy. Why contacted a journalist to talk about aspects of the fake project?
Advance the trust worthy staff.
Move the trusted and tested workers to important projects. Keep staff who can't be trusted on projects that are in the open.
Stop adding staff who bring complex problems to your company/brand/gov/mil.
Look for the best quality workers who can be trusted. Dont hire workers you have to trust you know nothing about.
Hire on merit and do much more research before accepting new staff.
Stop telling your staff project details they have no reason to know about.
Stop putting project details on networks and computers anyone within a secure company network can "find" and copy.
Look over what your staff search for in internal computer networks. Do they know project names/details they never got told about/are not working on?
Understand your staff. Secure your documents. Dont let internal data security become one large plain text data set.
Not on a network? Staff who are politically motivated can copy data out.
Domestic spying is now "Benign Information Gathering"
by BetterCloud. If you must be stupid and store valuable information in "the cloud", then we sell "Snake Oil" that you can lather all over yourself so you will feel better about your stupidity.
Unfortunately, it is only a "feel better" solution as there is nought that can be done to cure stupidity.
where i work, there have been a wave of security improvements, with super professional it people coming in and making big changes, enhanced security to multiple systems.
the people who are constantly ignoring and violating these rules, because they find them inconvenient, are managers and executives.
i am not sure if i even blame them - the mindset of a manager is kind of inherently incompatible with, say, learning to use a personal logon dongle, changing the way they have done something for 20 years. they view it as a useless impediment and kind of get a thrill out of throwing it in the waste bin.
Clearly a lot of American companies aren't putting on the newest Windows/everything else.
Then you have the NSA purposely weakening encryption. NSA secretly infiltrating Western companies to insert their own backdoors. Everything is becoming more connected. Those things are becoming more valuable.
But it's China and India that are making things less secure?
Wake the fuck up idiot.
You think Windows is fully secure? "More secure" is meaningless if it is still trivial to bypass it.
Why do you lie so much WindBourne?
Here, here and herefor example.
You also constantly claim links say what you want them to when they clearly do not.
Why falsely accuse other people of lying, when it's clearly you who is the liar?
Show some honour for once.
I call massive bullshit on the conclusion.
I do risk analysis for a living, among other things. I'm the Senior Information Security Architect at my company and I train risk managers and CISOs. Most importantly, I do quantitative risk analysis using actual numbers and statistics, not the "green, yellow, red" nonsense that most IT consultants sell you because it's the only thing they (barely) understand.
One of the most consistent findings I have almost every time is that expert intuition is wrong about risk. That's not exactly news, almost every book ever written about the topic confirms it. But the conclusion is just as obvious: What IT security experts feel is the biggest threat has a low correlation coefficient with what is actually real.
That doesn't mean insider threats aren't real, they definitely are and they typically do rank high in a properly conducted risk assessment. But there are almost always two types of risks that outrank them. First, the low-probability but high impact risks that more often than expected turn out to be existence-threatening and that fact makes them more important than their statistical value indicates. And secondly the bothersome low-impact but high-frequency (yes, probability becomes meaningless if the number of events can be higher than one) ones. They add up, and much more than you'd think.
Insider attacks are just the high-impact with sufficiently high probability events that come to the top of our intuitive understanding. Which has been empirically proven to be wrong in so many ways that books have been written about that alone.
62 percent of respondents believe the biggest security threat comes from the well-meaning but negligent end user.
Have the same respondents checked their incident management report to validate their feeling against recent events? How much damage have those end users actually caused and is that value within the confidence interval of your expectation? Do they know that you can take historic data and actually calculate the probability that your assessment of the risk is true given that data? Have they done it?
Assorted stuff I do sometimes: Lemuria.org
Who could have guessed it?
Companies which ... ... treat their employees as disposable "resources" bound by highly restrictive overreaching contracts, ... regard their customers with barely disguised contempt, ... treat regulations and laws as optional, ... laugh at taxation as being "for the little people", ... and generally act as douchebags ...
have problems with security due to the lack of loyalty!
How can this be happening?
Why are the (unpaid) natives lazy, the slaves sullen,
the oppressed and exploited unwilling to bend their backs with a smile?
Why the sabotage?
What is wrong with people?
(R)ule in Hell or (S)erve in Heaven [R]?
This 'kind of thing' happened to us when I worked for an employer. Some guy was getting laid off - he knew something was going to happen so (whilst I happened to be watching one machines load, noticed a massive filecopy of all our internal material from the server). Looking into it it was the guys PC (who had no business being in that location - yes 'obvious' permissions based security was something IT hadn't gotten to grips with as we were all a 'team' working together)
Anyway, caught this, notified my boss, employee was let go, but nothing ever happened about that USB drive he was copying to. He left with that information for a competitor. Our HR eventually got their finger out and contacted him about *cough* USB drive with info on we 'noticed' ,but obviously can feign ignorance and/or knowledge of entire thing, plus embarrassment for company regarding data breach if it had to be announced.
Moral of the story: Don't trust employees, and don't trust management either. You have to get off your arse and do things yourself sometimes(but also cover yourself in case HR are a bunch of arseholes). I learned a valuable lesson that day.
Said employer is no longer a market leader and has since been sold on. Because of HR engineering a divisive culture it all basically nosedived. Very glad to have got out of there when I did.
You can't help some people/'entities'. If you get into a company like that, get out. It may be hard, but it's better than the stress forced upon you by a company that persecutes and doesn't care about employees. It's basically like an 'abusive relationship'. Awful.
hindu dindu
Why? How much do they pay you?
Water is wet.