Global Threat Condition: Elevated
5 Steps to Stop Staff Snooping
60% of staff admit they would take valuable data
In a recent Cyber-Ark survey into “The recession and its effects on work ethics” carried out amongst 250 office workers in London’s busy Canary Wharf, a staggering sixty percent admitted they would take valuable data with them, if they could get away with it, were they faced with redundancy or the sack!
Remarkably, 40% confessed to having already snooped around the networks and downloaded sensitive company secrets from under their bosses nose in anticipation that they could lose their job.
Top of the list of desirable information to steal is customer and contact databases, with plans and proposals, product information, and access/password codes all popular choices and as having a perceived value – either monetary to an unscrupulous third party or as a negotiating tool in securing a new position.
Step 1: Establish a safe harbor
By establishing a safe harbor, or vault, for highly sensitive data (such as administrator account passwords, HR files, or intellectual property including corporate databases), security is built directly into the business process independent of the existing network infrastructure. This will protect the data from the security threats of not only nosy employees snooping around for information they should not be privy to, but also from hackers.
A digital vault is set up as a dedicated, hardened server that provides a single data access channel with only one way in and one way out. It is protected with multiple layers of integrated security including a firewall, VPN, authentication, access control, and full encryption. By separating the server interfaces from the storage engine, many of the security risks associated with widespread connectivity are removed.
Step 2: Automate privileged identities and activities
Ensure that privileged administrative and application accounts, and their underlying passwords are actively managed, secured, changed regularly, highly guarded from unauthorised use, and closely monitored, including full activity capture and recording. Once these privileged identities are being managed, make sure to proactively monitor and report actual adherence to the defined policies, and adopt the well-accepted security axiom of ‘Trust, but verify’. This is a critical component in safeguarding organisations and helps to simplify audit and compliance requirements, as companies are able to answer questions associated with “who” has access and “what” is being accessed.
Step 3: Identify all your privileged accounts
The best way to start managing privileged accounts is to create a checklist of operating systems, databases, appliances, routers, servers, directories, and applications throughout the enterprise. Each target system typically has between one and five privileged accounts. Add them up and determine which area poses the greatest risk. With this data in hand, organizations can easily create a plan to secure, manage, automatically change, and log all privileged passwords.
Step 4: Secure embedded application accounts
Up to 80 percent of system breaches are caused by internal users, including privileged administrators and power users, who accidentally or deliberately damage IT systems or release confidential data assets. Many times, the accounts leveraged by these users are the application identities embedded within scripts, configuration files, or an application. The identities are used to log into a target database or system and the fact that these credentials, are traditionally hard-coded, in clear-text and usually never changed is often overlooked within a traditional security review. Even if located, the account identities are difficult to monitor and log because they appear to a monitoring system as if the application (not the person using the account) is logging in.
These privileged, application identities are being increasingly scrutinized by internal and external auditors, especially during PCI- and SOX-driven audits, and are becoming one of the key reasons that many organizations fail compliance audits. Therefore, organizations must have effective control of all privileged identities, including application identities, to ensure compliance with audit and regulatory requirements.
Step 5: Avoid bad habits
To better protect against snoopers, organizations must establish best practices for securely exchanging privileged information. For instance, employees must avoid bad habits (such as sending sensitive or highly confidential information via courier). IT managers must also ensure they educate employees about the need to create and set secure passwords for their computers instead of using sequential password combination’s or their first names.
The risk of internal data misuse from snoopers can be significantly mitigated by implementing effective policies and technologies. In doing so, organizations can better manage, control, and monitor the power they provide to their employees and systems and avoid the negative economic and reputational impacts caused by an insider data breach. It would be unthinkable to leave money on a desk, an obvious temptation to anyone passing, instead it is always safely locked away. The time has come for companies to give sensitive information and key systems the same consideration, and as always – ‘Trust… But Verify’.
