Herbert H Thompson
Abstract
Every year corporations and government installations spend millions of dollars fortifying their network infrastructures. Firewalls, intrusion detection systems, and antivirus products stand guard at network boundaries, and individuals monitor countless logs and sensors for even the subtlest hints of network penetration. Vendors and IT managers have focused on keeping the wily hacker outside the network perimeter, but very few technological measures exist to guard against insiders - those entities that operate inside the fortified network boundary. The 2002 CSI/FBI survey estimates that 70 percent of successful attacks come from the inside. Several other estimates place those numbers even higher.
- 1. Power, R. 2002 CSI/FBI computer crime and security survey. Computer Security Issues and Trends VIII, 1 (Spring 2002).Google Scholar
- 2. Hayden, M. V. The Insider Threat to U. S. Government Information Systems. Report from NSTISSAM INFOSEC /1-99, July 1999.Google Scholar
- 3. Ferrie, P., and Lee, T. Analysis of W32.Mydoom.A@mm; http://securityresponse.symantec.com/avcenter/venc/ data/[email protected].Google Scholar
- 4. Bridwell, L., and Tippett, P. ICSA Labs 7th Annual Computer Virus Prevalence Survey 2001. ICSA Labs, 2001.Google Scholar
- 5. See, for example, Microsoft Security Bulletin MS03- 050, Vulnerability in Microsoft Word and Microsoft Excel Could Allow Arbitrary Code To Run: http: //www.microsoft.com/technet/security/bulletin/MS03- 050.mspx; or MS03-035, Flaws in Microsoft Word Could Enable Macros To Run Automatically: http://www.microsoft.com/technet/security/bulletin/ MS03-035.mspx.Google Scholar
- 6. Dos Santos, A., Vigna, G., and Kemmerer, R. Security testing of the online banking service of a large international bank. Proceedings of the First Workshop on Security and Privacy in E-Commerce (Nov. 2000).Google Scholar
- 7. Sophos Corporation. Top ten viruses reported to Sophos in 2003; http://www.sophos.com/virusinfo/ topten/200312summary.html.Google Scholar
Index Terms
- The Insider, Naivety, and Hostility: Security Perfect Storm?: Keeping nasties out if only half the battle.
Recommendations
Towards Countermeasure of Insider Threat in Network Security
INCOS '11: Proceedings of the 2011 Third International Conference on Intelligent Networking and Collaborative SystemsWe discuss countermeasure against insider threats in network security aspect. In the context of countermeasure against insider threats, there is no perimeter for access control in a network. A traditional access control process by using a firewall on a ...
Trust Enhanced Security Architecture for Detecting Insider Threats
TRUSTCOM '13: Proceedings of the 2013 12th IEEE International Conference on Trust, Security and Privacy in Computing and CommunicationsAttacks on the organization networks can be classified as external and internal attacks. For the purpose of this paper we consider that external attacks are generated by the attackers or from hosts outside the organization, and internal attacks are ...
Reviews
George Michael White
Troy was taken from the inside. The story of the Trojan horse, known to us for more then two millennia, has endured for a long time. It tells of a universal threat, that of attack from inside the walls. Network administrators have long been exposed to threats to their networks from viruses, Trojan horses and the like. These attacks can cripple networks, and, in their most virulent forms, can destroy files, databases, programs, and other computer resources, causing many millions of dollars worth of damage while damaging corporate reputations and compromising confidential customer data. The brief report discussed here examines the threat of internal attack on a corporation's computer resources from internal sources, mostly those sources that have been allowed to pass through the corporation's firewall defenses. "The issue is trust," as it says in the opening paragraph, trust that is either explicitly granted or which has been naively not withheld. The authors quote a report that states that some 70 percent of successful attacks come from the inside. This is not to say that the problem lies with inside collaborators, but, rather, that the attacks are launched by intruders who have been extended trust, and who have used this trust to launch their attacks. Integrated systems, such as those based on component object model (COM) or common object request broker architecture (CORBA), explicitly create trust relationships with components that reside on different computers. If one of these components is accessible to modification by a hostile agent, the component can be altered to wreak havoc on the entire system of which it is a part. Email can be designed to look trustworthy by using the address of a trusted correspondent, and can be embedded with a malicious attachment. The opening of this attachment by the unsuspecting recipient will cause the damage. The incorporation of unwanted actions in Microsoft Word, automatically launched through a macro incorporated into a document, is another example. Defense against this type of insider attack is difficult. The attacker may have a different objective than the one being used by the defender. Thus, attackers may not be attacking a specific online bank account. They may be attacking any bank account they can gain access to, or, perhaps, be attacking the bank itself. Thus, a defense that works against a brute force targeted at a specific account is unlikely to succeed against an attack on any random account for which the attacker can guess the personal identification number (PIN). If the goal was to deny access to any account at a bank, the defense may be completely counter-effective. After identification of an attack and an analysis of its nature, security mechanisms can often be cobbled together after the fact. The concepts of complete trust and mitigated trust are subtle, however, and are not easily added on if the system was not designed with these distinctions in mind. Some specifications for the implementation of specific actions in software have been published by interested parties, notably in the US Department of Defense Trusted Computer System Evaluation Criteria (the so-called orange book). These recommendations are a start, but work remains to be done. This paper's authors have done a good job of introducing these concepts in remarkably few pages. Those interested in an overview on the subject of trust, and its pervasiveness in information technology (IT) systems, would benefit from reading this paper. Specialists will have to do a lot more reading if they wish to master the subject. Online Computing Reviews Service
Access critical reviews of Computing literature here
Become a reviewer for Computing Reviews.
Comments