Cybercriminals, Insiders May Work Together To Attack Businesses

For 19 months, an employee at Johns Hopkins Hospital allegedly stole patients' identities, feeding the information to four outsiders who used the data to charge more than $600,000 in goods on store credit. Jasmine Amber Smith, 25, has been charged with using her inside access to fuel the identity theft ring.

Employees working with cybercriminals might not be the norm for security breaches, but it's not a rare crime, either, experts say. It's not unusual for cybercriminals to gain inside access through bribery and solicitation -- two components of social engineering, according to Verizon Business' Data Breach Investigations Report. Social engineering accounted for 28 percent of breaches analyzed in the report, with solicitation and bribery leading to nearly a third of those breaches.

"These were scenarios in which someone outside the organization conspired with an insider to engage in illegal behavior," the report says. "They recruit, or even place, insiders in a position to embezzle or skim monetary assets and data, usually in return for some cut of the score."

While stolen data can cause public relations headaches and lose the goodwill of customers, a company's customer data may not be its most valuable asset. Companies' proprietary knowledge and corporate secrets -- such as business plans, trade secrets, and sales forecasts -- are, on average, twice as valuable, according to a March 2010 report by analyst firm Forrester Research (PDF). Yet the loss of such data is usually not reported, experts say.

Because partnerships between cybercriminals and insiders are still uncommon, companies should focus their defenses on mainstream practices and tools for monitoring employee behavior, says Phil Neray, vice president of security strategy for Guardium, an IBM company.

An employee could stay within their authorized limits and still steal from the company, Neray observes.

"The only way to handle that is to rely on other forms of security than just identity and access management," Neray says. "The bad guys may have someone on the inside -- or a copy of the login credentials for your most sensitive systems -- so you have to start using anomaly detection, not just at the network level, but at the user-activity level."

Most of the cases of insider cooperation analyzed by Verizon Business -- which included data from the U.S. Secret Service -- involved embezzlement from banks, retailers, or the hospitality industry. Companies in those industries should have policies and technology in place to catch insiders focused on cash.

The report from Forrester found that aerospace, defense, electronics, and consulting companies had far more to lose from the theft of corporate secrets. A rogue employee stealing corporate information is generally the most expensive breach, according to that report.

Companies should be wary of signs that could show an employee's intentions. In its report, Verizon Business found that insiders who resort to crime frequently are cited multiple times for violations of corporate IT policies before they ever commit any illegal action. Doing regular background checks on employees who have access to sensitive systems is a must, experts say.

"We need to move beyond traditional forms of security, such as firewalls and antivirus," Guardium's Neray says, "and instead move to continuous, real-time monitoring of access to sensitive systems."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.