By Richard Adhikari
Approaches to cybersecurity have been in a state of flux
since the 1980s, when the move away from mainframes began. We went to mid-range
computers running UNIX; then client-server computing raised its many heads and
Windows on inexpensive x86 boxes became the thing.
The concept of enterprise security changed in tandem, from a
centralized approach to hub-and-spoke to endpoint security.
With the advent of mobile computing, the concept of
defending the network perimeter came along.
And, as hackers became increasingly sophisticated and data
breaches became more common, on the one hand, and mobile device use became more
common in the enterprise on the other, it became apparent that there is no one
solution to the problem of maintaining security, and the mantra now is defense
in depth, consisting of multi-layered security with threat and Advance
Persistent Threat (APT) monitoring.
Throughout it all, however, one thing has remained constant:
The threat from insiders.
Sure, data breaches like those at Anthem, Experian and
Heartland get all the press – but insider threats are far worse because
insiders know what to steal and are less likely to trip an alarm than an
outside hacker.
That’s one of the reasons phishing – and spearphishing in
particular – are an increasingly popular vector of attack.
The main focus of management tends to be external threats,
but that’s like the French depending on the Maginot Line in World War
II – those defenses can be bypassed.
Line staff are well aware of the problem – it’s the biggest
concern for 74% of respondents to this SANS Institute survey
- who held various posts in their companies. And one-fifth of the
respondents indicated they’ll increase spending on insider threat protection
this year.
Why isn’t management focusing more on the insider threat
then?
Management’s focus is on the corporation as a whole and on
the bottom line. And security is a cost center so management traditionally
underfunds and understaffs IT, preferring to spend on sales and marketing.
Also, external threats tend to hit the headlines more often and management has
to deal with the PR fallout and, possibly, angry shareholders.
Also, visibly armoring the network against external threats
looks good on management reports.
Consider these numbers:
- Over 68% of the respondents consider they can prevent or deter an insider threat and 51% believe their methods are effective or very effective
- 34% indicate they have suffered an insider incident or attack
- The 20% who will focus more on the insider threat will increase their spending by only 7% or more.
- 93% of the cyber security budget will be spent on external threats
At a time when the insider threat is growing, there is, in
short, a fundamental disconnect when it comes to thinking about and actually
tackling the insider threat problem. It’s time to stop treating insider threats as a red-headed
stepchild – often ignored and best forgotten.
-30-
