Government IT pros overconfident in insider threat detection

An extensive study conducted by Dimensional Research evaluated the confidence of IT professionals regarding the efficacy of seven key security controls, which must be in place to quickly detect a cyber attack in progress. Study respondents included 763 IT professionals from various industries, including 103 participants from federal government organizations.

Despite the persistent issues surrounding privileged access, almost one-third of federal government respondents disclosed they are not able to detect every non-privileged user’s attempt to access files.

In addition, 73 percent of federal government respondents assume their system would generate an alert or email within hours if a user inappropriately accessed file shares. Verizon’s 2016 DBIR reported that seventy percent data breaches caused by insider misuse took weeks, or even years, to detect.

According to Verizon’s 2016 DBIR, the public sector reported more security incidents than any other industry in 2015. Privileged access misuse and non-malicious events made up nearly half (forty-six percent) of the reported incidents.

Additional findings

• Seventy-eight percent of federal government respondents believe they could detect new devices on their network within hours. However, over half (fifty-two percent) of the respondents do not know exactly how long the detection process would take.
• Fifty-eight percent of federal government respondents say their automated tools do not pick up all the necessary information, such as the locations and departments, needed to identify unauthorized configuration changes to endpoint devices.
• A quarter (twenty-five percent) of federal government respondents say their standard patching process does not include validation of patch success on all target systems.
• Forty-eight percent of federal government respondents report that all detected vulnerabilities are not fixed within 15 to 30 days.

Authorization creep

“Authorization creep is something many organizations fail to address,” said Travis Smith, senior security research engineer for Tripwire. “As employees change roles or are promoted, their roles and responsibilities change; as does their access to confidential information. Protecting confidential information is more than reviewing access denied attempts; employees may be abusing authorized access as well. Following these recommended controls and continuous monitoring over critical and/or confidential information is vital to reduce the likelihood or impact of insider threat.”

Key security controls

The study is based on seven key security controls required by a wide variety of compliance regulations, including PCI DSS, SOX, NERC CIP, MAS TRM, NIST 800-53, CIS Top 20 and IRS 1075.

These controls also align with the United States Computer Emergency Readiness Team (US-CERT) recommendations and international guidance, such as the Australian Signals Directorate’s Strategies to Mitigate Targeted Cyber Intrusions.

The recommendations and guidance include:

• Accurate hardware inventory
• Accurate software inventory
• Continuous configuration management and hardening
• Comprehensive vulnerability management
• Patch management
• Log management
• Identity and access management.