INSIDER THREAT SECURITY BLOG

Interest in IAM solutions has increased substantially over the past few years, as the perpetrators of many high profile breaches have exploited stolen credentials to steal sensitive data and inflict damage on their victim organizations. And, as the popularity of IAM solutions has increased, the solutions are evolving. Once one-size-fits-all IAM products forced their customers’ processes to bend to the product’s requirements. Now, flexibility is replacing rigidity as the governing concept, as …

Authentication-based attacks remain a primary concern for many of our clients no matter the size or sector of their organization. While knowledge of these threats has increased, understanding the risk factors – and how to remediate them – has not. Most attacks are premised on stealing data for financial gain, and obtaining access is only the first step. Figuring out where valuable data is located, how it’s protected, and ultimately how to access it will take any infiltrator significant tim…

Access governance ‘in the cloud’ can be no different than access governance in general. For most organizations, at minimum, the same levels of controls will be required that were in force before the service was transitioned to a cloud-based offering. Adoption of Office 365, Dropbox and similar cloud services requires translating access governance concepts such as managing and reviewing access, monitoring activity, understanding where sensitive data is stored to those cloud-based services. The…

If you’ve heard the terms “lateral movement” or “golden tickets” recently, you might be wondering what they were referring to, and maybe not even realized they had anything to do with computer security. They are in fact references to the new breed of ‘Advanced Persistent Threats’ (APT) which have come to prominence as a result of some of the higher profile security breaches in the last 12 months. In fact, according to ISACA’s study “2015 Advanced Persistent Threat Awareness-Third Annual”, a f…

Unstructured data has always been the black sheep of the enterprise data security world. Securing access to applications and the data housed there has always been the priority, but that may be changing. Two recent, high-profile events suggest unstructured data may be moving from the cheap seats to the orchestra section soon. First, SailPoint, a leading IAM vendor, acquired Whitebox in July, specifically to extend their IAM solution to govern access to unstructured data. Second, the recentl…

Local administrator access is something that is present on nearly every information system around the globe. We all have the best intentions to use the local administrator for only the initial setup of the device, but many of us continue to use the accounts for various reasons. The main reason that this is a problem is that we lose central accountability and control of authorizations and authentications. This opens our systems up to sophisticated attacks that often fall completely under the r…