DuPont Insider Threat - Can it be prevented?

Any of you who saw the movie Breach that came out last weekend know (http://www.breachmovie.net/), Insider Threats are a real concern, and have been ever since we had trusted information. This is information other people want. Intelligence has long been a common target for espionage, ever since men had greed and went to war. Now a form of greed is growing, and has been for a thousand years, greed for intellectual property. Really, greed for money, but as knowledge has become power and wealth, the value of IP has really come in to its own.

The case broke last week. Gary Min worked at DuPont for 10 years, but between August 2005 and December 2005 he accessed 16,700 PDF files from DuPont’s Electronic Data Library. His home in Ohio was raided on February 14, 2006, but the case details were unsealed just last week. (http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9011367)

(http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1244018,00.html)

However, what few seem to be discussing is how to STOP insider threats. Carnegie Mellon University’s CERT has been looking at this problem for years (http://www.cert.org/insider_threat/) and last week I had the opportunity to sit down with one of their lead researchers, Dawn Cappelli, and discuss some of her work. (http://www.cert.org/podcast/bios.html#cappelli)

Ms. Cappelli has written several papers discussing insider threat and how to prevent it, one of the most applicable and fascinating is her Common Sense Guide to Prevention and Detection of Insider Threats. (http://www.cert.org/archive/pdf/CommonSenseInsiderThreatsV2.1-1-070118.pdf)

I captured this article as a source paper for my PhD Thesis, and thought the rest of you may enjoy some of my notes:

This paper is a set of thirteen recommendations to organizations to reduce the likelihood of a successful insider attack. These recommendations come from a study of the insider threat database, and include both technical and non-technical recommendations. It is because of this insider threat that some organizations will not engage in information sharing.

The article has thirteen points that provide best practices for managers to protect their assets from malicious insiders. These thirteen recommendations can create the foundation of this paper discussing recommendations to prevent or safeguard against insider threats.

PRACTICE 1: INSTITUTE PERIODIC ENTERPRISE-WIDE RISK ASSESSMENTS

This is the issue of enterprise trust, why some groups will not play with others in an enterprise environment. Performing an enterprise wide risk assessment allows management to capture a point-in-time and accurate picture of their organization’s assets, and the controls in place to safeguard those assets.

The authors point out that most organizations focus on external threats during a risk assessment, rather than malicious insiders. These may include business partners, partner organizations, employees, former employees, contractors, satellite offices, even customers allowed to process information at their site.

The other advantage to an enterprise risk assessment is that most organizations leave the responsibility to check and protect against malicious insiders with the insiders themselves, often those who may be most likely to perform the attack. When organizations do not acknowledge the potential risk of insider threats, or threats and vulnerabilities in general, the organization may compromise its ability to achieve its mission.

PRACTICE 2: INSTITUTE PERIODIC SECURITY AWARENESS TRAINING FOR ALL EMPLOYEES

Information security awareness is critical to identifying malicious insiders – as many of their activities may go undetected by security controls.

The authors recognize there is no “profile” for an insider, they may be of any level in the organization and any education. From CEO to the janitor malicious insiders take many forms, though all malicious insiders share common traits – they have a personality disposition that identifies their tendencies. Therefore all employees, especially managers, must have general awareness training to recognize common traits of malicious insiders. This training should cover how to recognize malicious insiders through behavior, not stereotypes. The training programs should create a culture of security and awareness, and make sense for the culture of the organization.

The training should be based on documented, reviewed, and approved policy that has been vetted through an organizational process. (See recommendation 13) Ad-hoc policy without foundation in well-thought principles will lose credibility and become unenforceable. A critical component to documented policy is a confidential system to report potential insiders, observed by other employees.

PRACTICE 3: ENFORCE SEPARATION OF DUTIES AND LEAST PRIVILEGE

Separation of duties and the two-person rule is a foundational component of ensuring checks and balances exist in any system where power or authority is exhibited over users. These principles also require support of the least privilege principle, whereby users are not granted access beyond what is necessary for them to perform their job.

When a system of checks and balances is not in place, especially between management and system administration, the situation is primed for a malicious insider. One convicted malicious insider was quoted as saying it was like “the fox guarding the henhouse”, (p22) whereby no management component was reviewing and auditing his activity.

PRACTICE 4: IMPLEMENT STRICT PASSWORD AND ACCOUNT MANAGEMENT POLICIES AND PRACTICES

Passwords are the first line of defense in most organizational information systems. It is for this need that dual-factor authentication has increased in popularity, especially for sensitive systems. However, more than just a stronger authentication mechanism is necessary to prevent malicious insiders. Password policies are necessary, and only useful when enforced. This is more than just password complexity, it also includes sharing passwords, disabling when an employee is terminated, and removing unknown, unused, or unrecognized passwords. After all, if an account that has not been used in six months is disabled, chances are the account user will not miss it, and probably doesn’t even know it exists.

Also consider that password cracking and strength testing may actually enable and help insiders, as they may be the individuals asked to perform this password audit. A password audit gives the insider a legitimate reason to audit for passwords. Instead, enforcing password complexity, lifetime, and history, combined with strong user education, will work to prevent weak passwords.

PRACTICE 5: LOG, MONITOR, AND AUDIT EMPLOYEE ONLINE ACTIONS

The purpose of logging and monitoring is to associate online actions with the employees who perform them. This assumes users are only using their assigned accounts, under practice #4. Auditing can compare online and offline records to check for changes.

Auditing should occur on both a periodic and random basis. The IRS has a great model to monitor and audit actions, their method is able to process large survey sizes with sampling patterns. This system works on flags. In addition, random audits may keep malicious insiders off-guard enough to dissuade them from attempting malicious actions.

One example of an insider used to change the financial records before each quarterly audits. This hid the insiders evidence of fraud, and it wasn’t discovered until much later during a bank audit. By this time over $500,000 was lost. Random audits would have increased the likelihood of discovering this insider earlier.

PRACTICE 6: USE EXTRA CAUTION WITH SYSTEM ADMINISTRATORS AND PRIVILEGED USERS

Users with the highest level of technical ability and information access are particularly privileged to be in an opportunity to commit malicious actions. As a result their accounts must have extra monitoring and audit controls in place. Organizations should ensure user’s actions can be traced back, especially for those with privileged access.

One example had an administrator as a malicious insider. Suspicious management began logging the administrators actions to a separate, hidden log file. When the administrator committed malicious acts and deleted their regular log file, they did not know about the hidden log file. As a result the company was able to prosecute the administrator based on the hidden log file.

It is also helpful to let administrators and privileged users know when they are being logged, as it may dissuade them from malicious acts. While this may not stop all, such as the example above, it may help to reduce the number of potential malicious insiders. One way to make administrators know they are being watched and held accountable for their actions is to use dual-controls, where two administrators with rights are required for certain privileged functions.

PRACTICE 7: ACTIVELY DEFEND AGAINST MALICIOUS CODE

Malicious code is still problematic in most organizations, though a strong anti-virus policy can capture most malicious programs. However, custom logic bombs, scripts, and underworld Trojan tools may not have an antivirus signature, and will be missed during AV scans. To safeguard against these attacks, a more systematic approach is needed. Organizations should establish and enforce baseline configurations for software and operating systems. This baseline “snapshot” can also be used to identify systems that are out of configuration. This is similar to the file integrity checker provide by Tripwire, which may create many false positives, but when used properly on high-risk systems, may capture small changes such as custom code or new software.

PRACTICE 8: USE LAYERED DEFENSE AGAINST REMOTE ATTACKS

Using a layered defense helps to prevent malicious insiders to access the network remotely, either from home where they are more bold, or after termination where they may be vengeful. Strong defensive tactics include securing your VPN configuration, reviewing and strengthening the security architecture, and properly disabling access after termination. Organizations should consider changing the passwords before the user is terminated, to ensure a clean cut-off.

PRACTICE 9: MONITOR AND RESPOND TO SUSPICIOUS OR DISRUPTIVE BEHAVIOR

A high number of malicious insiders had previous arrests and criminal convictions, showing disruptive behavior is prominent before they were hired. Managers and HR departments should be on the lookout for characteristic traits of malicious insiders. Though aggressive or confrontational employees have been a problem in the workplace before, this is a new threat the HR department must be taught. The employees should also be educated and encouraged to speak out when they notice suspicious activity, especially that which may indicate a malicious insider.

Previously when the disruptive employees were not discovered, they were able to migrate within the organization, changing from one job to another to avoid detection. These employees also often would boast of their technical prowess or insecurity of the organization, stating how easy it would be to “wipe out all their computer systems’.

PRACTICE 10: DEACTIVATE COMPUTER ACCESS FOLLOWING TERMINATION

It is a common industry practice to disable computer access following terminating an employee, however a shocking number of organizations do not have strong policies and procedures to disable these accounts, especially if the organization does not use a single sign-on solution. When formal policies to terminate access are not in place, the account disabling process tends to be ad-hoc, and holes to allow access may be left open.

Popularly overlooked accounts may also include shared accounts such as system administrator accounts or DBA accounts, which may be disruptive to other users to change their shared password. However, this is a demonstration of the need to have as few shared passwords as possible in the organization, and to instead focus only role based access and group privileges.

PRACTICE 11: COLLECT AND SAVE DATA FOR USE IN INVESTIGATIONS

When an organization has a possibility of criminal activity, it should take the preliminary investigative steps to secure any evidence, and isolate the situation as quickly as possible. The key questions are who, what, when and where – because we most likely already know why an insider chose to act – greed, fame, revenge.

There is a thorough list of data to capture from the moment an incident is discovered. System logs, data access, application usage, system commands, connection methods, and connection addresses are common. In addition, the host configuration should be captured, with memory state, processes running, even the data on the screen at the moment of discovery may hold clues.

PRACTICE 12: IMPLEMENT SECURE BACKUP AND RECOVERY PROCESSES

Backup and recovery policy and procedure is common, but unfortunately often not followed diligently. Ensure that multiple backup copies exist, and are stored in a secure location, with redundant copies stored at a secure offsite facility. Saboteurs may destroy both the system and the backup copies to ensure their destructive task has full impact. By maintaining separate backup copies, and additional copies of critical Intellectual Property, such as source code, organizations can limit the impact from an insider attack.

PRACTICE 13: CLEARLY DOCUMENT INSIDER THREAT CONTROLS

When organizations make it clear that it will be difficult to perform an insider attack, that employees are being watched and monitored on a random basis, this may decrease the likelihood of an insider to even think about malicious activity. This is communicated in the Rules of Behavior (ROB), which captures explicit roles and responsibilities when an individual joins the organization, and documents what controls are in place.

This should also be the basis of continuous annual training, to remind employees of their commitment, the policy, and the consequences of being caught. The mere fact that an individual may be watched is enough to deter some malicious insiders.