Insider Risk: Now More Than Ever
Posted by Robbie Forkish on Thu, Oct 08, 2009
It should come as no surprise that the current economic climate has increased the risk of fraud from insiders. But the degree to which the insider threat problem has increased is a surprise, as described in a Dark Reading article
Bankers Gone Bad: Financial Crisis Making The Threat Worse. According to a new survey by Actimize, nearly 80 percent of financial institutions worldwide say the insider threat problem has increased in the wake of the economic downturn. Only 28 percent of financial institutions had not suffered an insider breach in the past 12 months (not including the breaches we don't yet know about).
How do insiders commit fraud? The profile of the bank fraudster that typically commits these crimes is a trusted, full-time employee, one who is well-versed in its operations and how to circumvent them and remain under the radar. And a favorite method is to use a dormant account resulting from excessive user entitlements:
"Some security measures for limiting user access to sensitive data, such as minimizing user privileges, don't apply cleanly for banks... The best thing they can do is proactively monitor and look for signs that user entitlements aren't being abused."
If looking for signs that user entitlements aren't being abused was possible, everyone would do it, right? Well, it has to be cheap, too: according to the survey, the biggest single challenge to meeting the threat is the cost of doing so.
In the past 12 months, 70 percent of financial institutions say they have experienced a case of data theft by one of their employees. Nearly half of the banks in the Actimize survey say they are losing 1% to 4% -- four percent! -- of their total revenues to insider fraud. With that as incentive, the most plausible explanation for failing to prevent fraud resulting from excessive user entitlements is that banks don't know how. What they do know is that perfect access control isn't possible, and that Identity Management (IdM) systems combined with manual reviews still fails to identify many excessive entitlements.
And they also know that excessive entitlements (also known as excessive access rights) was the top audit finding for the past two years.
Cloud Compliance is developing an Identity and Access Assessment (IdAA) solution to manage entitlements (also called privileges, or access rights). We identify users with excess entitlements, and provide tools for isolating high levels of over-entitlement by group, business unit or by application. Such tools enable root cause identification, and provide the necessary insight for remediation and process improvement. Furthermore, due to our global visibility as a cloud-based SaaS solution, we capture statistics industry-wide that our customers can access for setting their own policy benchmarks. Finally, the Cloud Compliance SaaS solution requires no software to install, maintain and operate, no appliances to deploy, no consultants, advisors or professional services to deploy, and no huge upfront capital expense to incur.