Insider Threats

Despite some variation from year to year, inside jobs occur about as often as outside jobs. The lesson here, though, surely is as simple as this: organizations have to anticipate attacks from all quarters.

CSI/FBI COMPUTER CRIME AND SECURITY SURVEY 2005

Examples

  • Vodafone Greece
    • Targeted 100+ high-ranking officials
      • Prime minister of Greece & his wife
      • Ministers: national defense, foreign affairs, justice
      • Greek European Union commissioner
      • Mayor of Athens
    • Started before Aug'04, continued till March'05
    • Detected accidentally due to rootkit update misconfig
    • Traced to an insider in Vodafone
    • Vodafone fined $76M
  • Edward Snowden

Two Types of Insider Attackers

  • Traitors
    • A legitimate user with proper access credentials can be evil
    • Full knowledge of systems & security policies
  • Masqueraders
    • An attacker who has stolen/obtained and uses credentials of a legitimate user

Insight

  • Behavior performances can be different from normal users and attackers
  • Behavior is not something that can be easily stolen
  • When traitors do evil, performances deviate from normal behavior
    • Even attackers simulate normal users, they will be exposed when they start attacks

Insider Attacks

Forms of Attack

  • Unauthorized extraction, duplication, or exfiltration of data
  • Tampering with data (unauthorized changes of data or records)
  • Destruction and deletion of critical assets
  • Downloading from unauthorized sources or use of pirated software which might contain backdoors or malicious code
  • Eavesdropping and packet sniffing
  • Spoofing and impersonating other users
  • Social engineering attacks
  • Misuse of resources for non-business related or unauthorized activities
  • Purposefully installing malicious software

Characteristics of Insider Attacks

  • Most incidents required little technical sophistication
  • Actions were planned
  • Motivation was financial gain
  • Acts were committed while on the job
  • Incidents were usually detected by non-security personnel
  • Incidents were usually detected through manual procedures

Detection Approach

  • Shell command sequences (CLI)
  • System calls
  • Database/file accesses
  • OS logs
  • Web request
  • Keystroke/Mouse dynamics
  • Honeypots
Masquerader Traitor
One/Two-Class Classifiers: Unix Command Sequences High - Unfamiliar with local environment and user behavior Medium - Can possibly mimic another normal user or train the classifier
Unix Audit Events Medium - Given proper credentials and might not trigger alerts Low - Application level malicious acts may not manifest as unusual events
Unix System Calls Medium - Might not violate system call profile Low - Application level malicious acts may not manifest as unusual events
Window Usage Events Medium - Given proper credentials and might not trigger alerts Low - Application level malicious acts may not manifest as unusual events
Windows Registry access Medium - unless malicious programs access Registry Medium - unless malicious programs access Registry
Network Activity Audit Medium - If attack uses network and attribution is possible High - If attack uses network and attribution is possible
Honeypots and Decoy Technologies High - Unfamiliar with local information and likely to interact with honeypot Medium - Unlikely to interact if aware of the location of honeypots

References

  • The Athens Affair
  • Insider Attack and Cyber Security: Beyond the Hacker, chapter "A Survey of Insider Attack Detection Research"
  • CS 259D Lecture 3

results matching ""

    No results matching ""