Which type of cybercriminal is the most likely to create malware to compromise an organization by stealing credit card information?

What is an insider threat?

An insider threat is a malicious activity against an organization that comes from users with legitimate access to an organization’s network, applications or databases. These users can be current employees, former employees, or third parties like partners, contractors, or temporary workers with access to the organization’s physical or digital assets. While the term is most commonly used to describe illicit or malicious activity, it can also refer to users who unintentionally cause harm to the business.

Inhaltsverzeichnis Show

What is an insider threat?
Insider threat statistics: How big is the problem?
Insider threat motivations
How are employees compromised
Detecting insider threats: tell-tale signs
Four ways to prepare against insider threats
Learn More About Insider Threat
See Our Additional Articles on Key Information Security Topics
Which type of cybercriminal is the most likely to create malware to compromise an organization by stealing credit card inform?
What non technical method could a cybercriminal use to gather sensitive information from an organization?
What hashing algorithm is recommended for the protection of sensitive information?
What is an example of early warning systems that can be used to thwart cybercriminals?

Why do insiders go bad? The motivation for insiders vary, most often, breaches are financially motivated. However, breaches can also result from espionage, retaliation or grudge towards the employee, or just carelessness. Insider threats are more common in some industries — such as healthcare, the financial sector and government institutions — but they can compromise the information security of any company.

Read on to get a complete picture of the insider threat problem: what are insider threats, how they operate, and how attackers compromise insiders to carry out attacks. We’ll also cover organizational and behavioral signals and tools that can help you detect insider threats, and four key strategies to protect against insider threats.

There are several types of insider threats:

Malicious Insider—an employee or contractor who knowingly looks to steal information or disrupt operations. This may be an opportunist looking for ways to steal information that they can sell or which can help them in their career, or a disgruntled employee looking for ways to hurt an organization, punish or embarrass their employer. An example of a malicious insider are the various Apple engineers who were charged with data theft for stealing driverless car secrets for a China-based company.
Negligent Insider—an employee who does not follow proper IT procedures. For example, someone who leaves their computer without logging out, or an administrator who did not change a default password or failed to apply a security patch. An example of a negligent insider is the data analyst who, without authorization, took home a hard drive with personal data from 26.5 million U.S. military veterans, that was stolen in a home burglary.
Compromised Insider—a common example is an employee whose computer has been infected with malware. This typically happens via phishing scams or by clicking on links that cause malware downloads. Compromised insider machines can be used as a “home base” for cybercriminals, from which they can scan file shares, escalate privileges, infect other systems, and more. As is the case of the recent Twitter breach where attackers used a phone spear phishing attack to gain access to employee credentials and their internal network. The attackers managed to gain information about Twitter’s processes and target employees with access to account support tools to hack high-profile accounts and spread a cryptocurrency scam that earned $120,000.

Insider threat statistics: How big is the problem?

Insider threats are a growing problem, as evidenced by a recent Ponemon study “2020 Cost of Insider Threats: Global Report”:

60% of organizations had more than 30 insider-related incidents per year
62% of the insider-related incidents were attributed to negligence
23% of the insider-related incidents were attributed to criminal insiders
14% of the insider-related incidents were attributed to user credential theft
Number of insider-related incidents increased by 47% in two years
Companies spend an average of $755,760 on each insider-related incident

Insider Threats are difficult to detect because the threat actor has legitimate access to the organization’s systems and data. That is because an employee needs access to the resources like email, cloud apps or network resources to successfully do their job. Depending on the role, some employees will also need access to sensitive information like financials, patents, and customer information.

Because the threat actor has legitimate credentials and access to the organization’s systems and data, many security products would tag the behavior as normal and not trigger any alerts. Insider Threats become harder to detect as they become more complicated. For example, a threat actor could perform lateral movement to hide their tracks and access high value targets. Or, an insider could leverage a flaw in the system to escalate privileges, as described below.

Insider threats and privilege escalation

Insiders can carry out their plans via abuse of access rights. The attacker may try what is known as privilege escalation, which is taking advantage of system or application flaws to gain access to resources they do not have permission to access.

Figure 1 – Using privilege escalation, an attacker can move horizontally, gaining access to other user or service accounts, or vertically, gaining greater access via power users or administrators.

In some cases, abuse of access rights takes the form of someone with privileged access abusing their power. In 2008, a system administrator working for the San Francisco city government blocked access to the city’s network and refused to surrender the admin passwords. The worker was disgruntled, and his job was in jeopardy, it was revealed.

These complex threats cannot be detected with traditional correlation rules because they are unknown threats. Instead, a security analyst would need to understand the user’s normal activity to be able to identify abnormal and potentially malicious activity.

Insider threat motivations

More often than not, the ultimate goal of an insider threat is financial gain. Whether this is a malicious insider who has accepted cash for trade secrets, a negligent user who sends a wire-transfer to a fraudulent bank account after receiving a spoofed email from an “executive,” or a compromised insider whose credentials are stolen and used by attackers to exfiltrate and sell personally identifiable information (PII) of their patients. But there are many motivators for insider threats: sabotage, fraud, espionage, reputation damage or professional gain. Insider threats are not limited to exfiltrating or stealing information, any action taken by an “insider” that could negatively impact an organization falls into the insider threat category.

Insider Type	Motivations	Example	Risks
Malicious	Making money or avenging a slight	Terminated employee plants a logic bomb to execute malicious code	Theft of core company intellectual property. Disruption of operations. Damage to company reputation.
Negligent	Ignorance or carelessness	Careless employee posts corporate data in public cloud container	Theft of core company intellectual property. Disruption of operations. Damage to company reputation.
Compromised	Oblivious to the risk they pose	An attacker uses compromised credentials to exfiltrate corporate data	Access to sensitive company systems or assets. Theft of core company intellectual property.

Table 1 – Insider threats are caused by malicious, negligent, and compromised individuals whose motivations are quite different.

How are employees compromised

There are several means by which an employee can become a compromised insider:

Phishing—a cybercrime in which a target individual is contacted via email or text message by someone posing as a legitimate institution in order to lure the individual into providing sensitive data, such as personally identifiable information (PII), banking and credit card details, and passwords. Some phishing schemes may also try to entice a target to click on a link that triggers a malware download.

Malware infection—a cybercrime when a machine is infected with malicious software – malware – infiltrates your computer. The goal of the malware in the case of a compromised insider is to steal sensitive information or user credentials. A Malware infection can be initiated by clicking on a link, downloading a file, or plugging in an infected USB, among other ways.

Credential theft—a cybercrime aimed at stealing the username and password – the credentials – of a targeted individual. Credential theft can be done in a variety of ways. Phishing and malware infection, mentioned above, are common. Some criminals may engage in social engineering, which is the use of deception to manipulate individuals into divulging their credentials. A bogus call from the IT helpdesk, where the user is asked by the attacker to confirm their username and password, is a common technique.

Pass-the-hash—a more advanced form of credential theft where the hashed – encrypted or digested – authentication credential is intercepted from one computer and used to gain access to other computers on the network. A pass-the-hash attack is very similar in concept to a password theft attack, but it relies on stealing and reusing password hash values rather than the actual plain text password.

Detecting insider threats: tell-tale signs

Organizations can spot or predict insider threats by observing user behavior in the workplace and online. Being proactive may allow organizations to catch potentially malicious insiders before they exfiltrate proprietary information or disrupt operations.

The following table shows behaviors and organizational traits that are tell-tale signs of an insider threat.

Employee/Contractor Behavioral Trait	Organizational Event
Interest outside scope of their duties	Layoff
Working unusual hours without authorization	Annual merit cycle – individuals not promoted
Excessive negative commentary about organization	Annual merit cycle – individuals not given raises
Drug or alcohol abuse
Financial difficulties
Gambling debt
Change in mental state

Table 2 – Employee or contractor behavioral traits, and organizational events, that should be heeded to reduce the risk of insider threats.

IT security should also observe online behavior traits. The following table lists some of the most common suspicious behaviors.

Behavior	Malicious Insider	Compromised Insider
Badging into work at unusual times	X
Logging in at unusual times	X	X
Logging in from unusual location		X
Accessing systems/applications for the first time	X	X
Copying large amounts of information	X	X

Table 3 – Behaviors that suggest malicious or compromised insiders.

Four ways to prepare against insider threats

There are many things an organization can do to combat insider threats. Here are the four main areas to focus on.

1. Train Your Employees

Conduct regular anti-phishing training. The most effective technique is for the organization to send phishing emails to its users and focus training on those users who do not recognize the email as a phishing attempt. This will help reduce the number of employees and contractors who may become compromised insiders.

Organizations should also train employees to spot risky behavior among their peers and report it to HR or IT security. An anonymous tip about a disgruntled employee may head off a malicious insider threat.

2. Coordinate IT Security and HR

There is no shortage of stories about IT security teams that were blindsided by layoffs. Coordination between the CISO and the head of HR can help prepare IT security. Simply putting affected employees on a watchlist and monitoring their behavior can thwart many threats. Likewise, HR may advise IT security about certain employees that were passed over for a promotion or not given a raise.

3. Build a Threat Hunting Team

Many companies have dedicated threat hunting teams. Rather than reacting to incidents after they are discovered, threat hunting takes a proactive approach. Dedicated individuals on the IT security team look for telltale signs, such as those listed above, to heed off theft or disruption before it occurs.

4. Employ User Behavioral Analytics

User Behavior Analytics (UBA), also known as User and Entity Behavior Analytics (UEBA), is the tracking, collecting, and analyzing of user and machine data to detect threats within an organization. Using various analytical techniques, UEBA determines anomalous from normal behaviors. This is typically done by collecting data over a period of time to understand what normal user behavior looks like, then flagging behavior that does not fit that pattern. UEBA can often spot unusual online behaviors – credential abuse, unusual access patterns, large data uploads – that are telltale signs of insider threats. More importantly, UEBA can often spot these unusual behaviors among compromised insiders long before criminals have gained access to critical systems.

Insider threats are not going away. But by better understanding the different types of insiders and the behaviors they exhibit, organizations can be better prepared to fight these threats. A combination of training, organizational alignment, and technology is the right approach.

Learn More About Insider Threat

Fighting Insider Threats with Data Science

One of the key benefits of a security information and event management (SIEM) platform with user and entity behavior analytics (UEBA) is the ability to solve security use cases without having to be a data scientist. The platform masks the underlying complexity of “doing data science” so that security operations center (SOC) staff can focus on keeping the enterprise safe from attacks. But if you’ve wondered what exactly is going on under the hood, this article provides a high-level glimpse of how Exabeam Security Management Platform (SMP) uses data science to address one of the most important and elusive use cases: insider threat detection.

Insider Threat Indicators: Finding the Enemy Within

The value of sensitive data and information to organizations is higher than ever. Many organizations allocate numerous resources to their cyber defensive measures and form a security operations center (SOC) to protect themselves against cyber attacks.

While cyber attacks are a threat to companies, they are not as common and in some cases, not as dangerous, as insider threats which are also much harder to detect.

In this article, we provide you with information about insider threats, including what is an insider threat, the indicators that can help you detect insider threats and the best tools to provide protection against such threats.

How to Find Malicious Insiders: Tackling Insider Threats Using Behavioral Indicators

Insider threats are insidious. Because they work within your network, have access to critical systems and assets, and use known devices—they can be very difficult to detect.

Crypto Mining: A Potential Insider Threat Hidden In Your Network

Exabeam’s newly released research looks inside the hidden world of cryptocurrency mining by malicious insiders. Imagine a trusted and privileged insider, a system administrator for example, who has wide access to your network mining cryptocurrency. The activity is undetected and in addition to draining valuable resources increases the attack surface on your network.

The report also provides recommendations on what your organization can do to protect your business from such shadow mining.

See Our Additional Articles on Key Information Security Topics

For more in-depth guides on additional information security topics such as data breaches, see below:

Cybersecurity Threats Guide

Cybersecurity threats are intentional and malicious efforts by an organization or an individual to carry out attacks on another organization or individual.

See top articles in our cybersecurity threats guide

Information Security Threats and Tools for Addressing Them
Drive By Downloads: What They Are and How to Avoid Them
Cyber Crime: Types, Examples, and What Your Business Can Do

SIEM Security Guide

SIEM security refers to the integration of SIEM with security tools, network monitoring tools, performance monitoring tools, critical servers and endpoints, and other IT systems.

See top articles in our siem security guide

7 Open Source SIEMs: Features vs. Limitations
SIEM Solutions: How They Work and Why You Need Them
Combating Cyber Attacks With SOAR

User and entity behavior analytics Guide

UEBA stands for User and Entity Behavior Analytics which is a category of cybersecurity tools that analyze user behavior, and apply advanced analytics to detect anomalies.

See top articles in our User and Entity Behavior Analytics guide

What Is UEBA and Why It Should Be an Essential Part of Your Incident Response
User Behavior Analytics (UBA/UEBA): The Key to Uncovering Insider and Unknown Security Threats
Behavioral Profiling: The Foundation of Modern Security Analytics

Security Operations Centers Guide

A security operations center (SOC) is traditionally a physical facility with an organization, which houses an information security team.

See top articles in our security operations center guide

How to Build a Security Operations Center for Small Companies
Security Operations Center Roles and Responsibilities
SecOps: 7 Steps to : Taking DevOps One Step Further

DLP Guide

DLP is an approach that seeks to protect business information. It prevents end-users from moving key information outside the network.

See top articles in our DLP guide

Data Loss Prevention Policy Template
Data Loss Prevention Tools
Security Breaches: What You Need to Know

Incident Response Guide

Incident response is an approach to handling security breaches.

See top articles in our incident response guide

The Complete Guide to CSIRT Organization: How to Build an Incident Response Team
How to Quickly Deploy an Effective Incident Response Policy
Incident Response Plan 101: How to Build One, Templates and Examples

Regulatory Compliance Guide

See top articles in our regulatory compliance guide

SOX Compliance: Requirements and Checklist
Protect Personal Data With GDPR Compliance
PCI Compliance: A Quick Guide
What Is the HIPAA Compliance Standard and How to Adhere to It?

Which type of cybercriminal is the most likely to create malware to compromise an organization by stealing credit card inform?

2 / 2 ptsQuestion 2Which type of cybercriminal is the most likely to create malware tocompromise an organization by stealing credit card information? black hat hackersCorrect!

What non technical method could a cybercriminal use to gather sensitive information from an organization?

Question 10What is a nontechnical method that a cybercriminal would use to gathersensitive information from an organization? ransomewareman-in-the-middlepharmingsocial engineeringCorrect! Correct!