Category Archives: Cyberfraud & Data Breaches

The Threat Within

Our Chapter’s May 16th and 17th upcoming training seminar on CYBER FRAUD AND DATA BREACHES emphasizes that corporate insiders represent one of the largest threats to an organization’s vital information resources. Insiders are individuals with access or inside knowledge about an organization, and such access or knowledge gives them the ability to exploit that organization’s vulnerabilities.  Insiders enjoy two critical openings in the security structure that put them in a position to exploit organizations’ information security vulnerabilities:

• the trust of their employers
• their access to facilities

Information theft by insiders is of special concern when employees leave an organization. Often, employees leave one organization for another, taking with them the knowledge of how their former organization operates, as well as its pricing policies, manufacturing methods, customers, and so on.

The ACFE tells us that insiders can be classified into three categories:

• Employees:  employee insiders are employees with rights and access associated with being employed by the organization.
• Associates: insider associates are people with physical access to an organization’s facilities, but they are not employees of the organization (e.g., contractors, cleaning crews).
• Affiliates: insider affiliates are individuals connected to pure insiders or insider associates (e.g., spouse, friend, client), and they can use the credentials of those insiders with whom they are connected to gain access to an organization’s systems or facilities.

There are many types of potential insider threats, and they can be organized into the following categories:

• Traitors
• Zealots
• Spies
• Browsers
• Well-intentioned insiders

A traitor is a legitimate insider who misuses his or her insider credentials to facilitate malicious acts.  When a trusted insider misuses his or her privileges to violate a security policy, s/he becomes a traitor. Below are some signs that an insider may be a traitor:

• Unusual change in work habits;
• Seeking out sensitive projects;
• Unusual work hours;
• Inconsistent security habits;
• Mocking security policies and procedures;
• Rationalizing inappropriate actions;
• Changes in lifestyle;
• Living beyond his or her means.

Zealots are trusted insiders with strong and uncompromising beliefs that clash with their organization’s perspectives on certain issues and subjects. Zealots pose a threat because they might exploit their access or inside knowledge to “reform” their organizations.
Zealots might attempt reform by:

• Exposing perceived shortcomings of the organization by making unauthorized disclosures of information to the public or by granting access to outsiders;
• Destroying information;
• Halting services or the production of products.

Zealots believe that their actions are just, no matter how much damage they cause.

A spy is an individual who is intentionally placed in a situation or organization to gather intelligence. A well-placed corporate spy can provide intelligence on a target organization’s product development, product launches, and organizational developments or changes.

Spies are common in foreign, business, and competitive intelligence efforts.

Browsers are insiders who are overly curious about information to or of which they do not need access, knowledge or possession to carry out their work duties. Their curiosity drives them to review data not intended for them.  Browsers might “browse” through information that they have no specific need to know until they find something interesting or something they can use. Browsers might use such information for personal gain, or they might use it for:

• Obtaining awards;
• Supporting decisions about promotions;
• Understanding contract negotiations;
• Gaining a personal advantage over their peers.

Browsers can be the hardest insider threat to identify, and they can be even harder to defeat.

The well-intentioned insider is an insider who, through ignorance or laziness, unintentionally fosters security breaches. Well-intentioned insiders might foster security breaches by:

• Disabling anti-virus software;
• Installing unapproved software;
• Leaving their workstations or facilities unlocked;
• Using easy-to-crack passwords;
• Failing to shred or destroy sensitive information.
While well-intentioned individuals might be stellar employees when it comes to work production, their ignorance or laziness regarding information security practices can be disastrous.

CFE’s need to understand that there are numerous motivations for insider attacks including:

• Work-related grievances;
• Financial gain;
• Challenge;
• Curiosity;
• Spying for competitors;
• Revenge;
• Ego;
• Opportunity;
• Ideology (e.g., “I don’t like the way my organization conducts business.”)

There are many ways our client organizations can combat insider threats. The most effective mitigation strategies recommended by the ACFE are:

• Create an insider threat program. To combat insider threats, management should form an insider threat team, create related policies, develop processes and implement controls, and regularly communicate those policies and controls across the organization.
• Work together across the organization. To be successful, efforts to combat insider threats should be communicated across the silos of management, IT, data owners, software engineers, general counsel, and human resources.
• Address employee privacy issues with general counsel. Because employees have certain privacy rights that can affect numerous aspects of the employer-employee relationship, and because such rights may stem from, and be protected by, various elements of the law, management should consult legal counsel whenever addressing actions impacting employee privacy.
• Pay close attention at times of resignation/ termination. Because leaving an organization is a key time of concern for insider threats, management should be cautious of underperforming employees, employees at risk of being terminated, and of employees who will likely resign.
• Educate managers regarding potential recruitment. Management should train subordinates to exercise due diligence in hiring prospective employees.
• Recognize concerning behaviors as a potential indicator. Management must train managers and all employees to recognize certain behaviors or characteristics that might indicate employees are committing or are at risk of committing a breach. Common behavioral red flags are living beyond one’s financial means, experiencing financial difficulties, having an uncommonly close relationship with vendors or customers, and demonstrating excessive control over their job responsibilities.
• Mitigate threats from trusted business partners. Management should subject their organization’s contractors and outsourced organizations to the same security controls, policies, and procedures to which they subject their own employees.
• Use current technologies differently. Most organizations have implemented technologies to detect network intrusions and other threats originating outside the network perimeter, and organizations with such technologies should use them to the extent possible to detect potential indicators of malicious insider behavior within the network.
• Focus on protecting the most valuable assets. Management should dedicate the most effort to securing its most valuable organizational assets and intellectual property against insider threats.
• Learn from past incidents. Past incidents of insider threats and abuse will suggest areas of vulnerability that insiders will likely exploit again.
Additionally:
• Focus on deterrence, not detection. In other words, create a culture that deters any aberrant behavior so that those who continue to practice that behavior stand out from the “noise” of normal business; focus limited investigative resources on those individuals.
• Know your people—know who your weak links are and who would be most likely to be a threat. Use human resources data to narrow down threats rather than looking for a single needle in a pile of needles.
• Identify information that is most likely to be valuable to someone else and protect it to a greater degree than the rest of your information.
• Monitor ingress and egress points for information (e.g., USB ports, printers, network boundaries).
• Baseline normal activity and look for anomalies.
Other measures organizations might consider taking to combat insider threats include:
• Educate employees as to what information is proprietary and confidential.
• Require that all employees and third-party vendors and contractors sign nondisclosure agreements; written agreements providing that all proprietary and confidential information learned during their relationship must be kept confidential and must not be disclosed to anyone, upon the commencement and termination of employment or contracts.
• Ensure that all an organization’s third-party vendors and contractors perform background checks on all third-party employees who will have access to the organization’s information systems.
• Prohibit employees, contractors, and trusted business partners from printing sensitive documents that are not required for business purposes.
• If possible, avoid connecting information systems to those of business partners.

Also, when possible, management should conduct exit interviews with departing employees. During an exit interview, the departing employee should be advised about the organization’s trade secrets and confidential information, as well as any obligation not to disclose or use such information for his or her own benefit or for the benefit of others without express written consent. Also, the employee should be given a form to sign stating that s/he was informed that any proprietary information should not be disclosed and that s/he agrees not to disclose any such information without consent.

Finally, when management terminates its relationship with an insider, it should immediately deactivate the insider’s access to company tools and resources.

Please consider joining us for at our May 16th and 17th Spring training event, Cyber Fraud and Data Breaches for 16 CPE credits!  You may register and pay on-line here.

Cyberfraud & Data Breaches – May 2018 Training Event

On May 16th and 17th, our Chapter, supported by our partners, national ACFE and the Virginia State Police, will present our sixteenth Spring training event, this time on the subject of CYBERFRAUD AND DATA BREACHES.  Our presenter will be CARY E. MOORE, CFE, CISSP, MBA; ACFE Presenter Board member and internationally renowned author and authority on every aspect of cybercrime.  CLICK HERE  to see an outline of the training, the agenda and Cary’s bio.  If you decide to do so, you may REGISTER HERE.  Attendees will receive 16 CPE credits, and a printed manual of over 300 pages detailing every subject covered in the training.  In addition, as a door prize, we will be awarding, by drawing, a printed copy of the 2017 Fraud Examiners Manual, a $200 value!

As the relentless wave of cyberattacks continues, all our client organizations are under intense pressure from key stakeholders and regulators to implement and enhance their anti-fraud programs to protect customers, employees and the valuable information in their possession. According to research from IBM Security and the Ponemon Institute, the average total cost per company, per event of a data breach is US $3.62 million. Initial damage estimates of a single breach, while often staggering, may not consider less obvious and often undetectable threats such as theft of intellectual property, espionage, destruction of data, attacks on core operations or attempts to disable critical infrastructure. These knock-on effects can last for years and have devastating financial, operational and brand ramifications.

Given the broad regulatory pressures to tighten anti-fraud cyber security controls and the visibility surrounding cyber risk, a number of proposed regulations focused on improving cyber security risk management programs have been introduced in the United States over the past few years by various governing bodies of which CFEs need to be aware. One of the more prominent is a regulation issued by the New York Department of Financial Services (NYDFS) that prescribes certain minimum cyber security standards for those entities regulated by the NYDFS. Based on the entity’s risk assessment, the NYDFS law has specific requirements around data encryption, protection and retention, third party information security, application security, incident response and breach. notification, board reporting, and annual certifications.

However, organizations continue to struggle to report on the overall effectiveness of their cyber security risk management and anti-fraud programs. The American Institute of Certified Public Accountants (AICPA) has released a cyber security risk management reporting framework intended to help organizations expand cyber risk reporting to a broad range of internal and external users, including the C-suite and the board of directors (BoD). The AICPA’s reporting framework is designed to address the need for greater stakeholder transparency by providing in-depth, easily consumable information about an organization’s cyber risk management  program. The cyber security risk management examination uses an independent, objective reporting approach and employs broader and more flexible criteria. For example, it allows for the selection and utilization of any control framework considered suitable and available in establishing the entity’s cyber security objectives and developing and maintaining controls within the entity’s cyber security risk management program, whether it is the US National Institute of Standards and Technology (NIST)’s Cybersecurity Framework, the International Organization for Standardization (ISO)’s ISO 27001/2 and related frameworks, or internally developed frameworks based on a combination of sources. The examination is voluntary, and applies to all types of entities, but should be considered a leading practice that provides the C-suite, boards and other key stakeholders clear insight into an organization’s cyber security program and identifies gaps or pitfalls that leave organizations vulnerable.

Cyber security risk management examination reports are vital to the fraud control program of any organization doing business on-line.  Such reports help an organization’s BoD establish appropriate oversight of a company’s cyber security risk program and credibly communicate its effectiveness to stakeholders, including investors, analysts, customers, business partners and regulators. By leveraging this information, boards can challenge management’s assertions around the effectiveness of their cyber risk management programs and drive more effective decision making. Active involvement and oversight from the BoD can help ensure that an organization is paying adequate attention to cyber risk management. The board can help shape expectations for reporting on cyber threats and fraud attempts while also advocating for greater transparency and assurance around the effectiveness of the program.

Organizations that choose to utilize the AICPA’s cyber security attestation reporting framework and perform an examination of their cyber security program may be better positioned to gain competitive advantage and enhance their brand in the marketplace. For example, an outsource retail service provider (OSP) that can provide evidence that a well-developed and sound cyber security risk management program is in place in its organization can proactively provide the report to current and potential customers, evidencing that it has implemented appropriate controls to protect the sensitive IT assets and valuable data over which it maintains access. At the same time, current and potential retailor customers of an OSP want the third parties with whom they engage to also place a high level of importance on cyber security. Requiring a cyber security examination report as part of the selection criteria would offer transparency into  outsourcers’ cyber security programs and could be a determining factor in the selection process.

The value of addressing cyber security related fraud concerns and questions by CFEs before regulatory mandates are established or a crisis occurs is quite clear. The knowledgeable CFE can help our client organizations view the new cyber security attestation reporting frameworks as an opportunity to enhance their existing cyber security and anti-fraud programs and gain competitive advantage. The attestation reporting frameworks address the needs of a variety of key stakeholder groups and, in turn, limit the communication and compliance burden. CFE client organizations that view the cyber security reporting landscape as an opportunity can use it to lead, navigate and disrupt in today’s rapidly evolving cyber risk environment.

Please decide to join us for our May Training Event on this vital and timely topic!  YOU MAY REGISTER 0N-LINE HERE.  You can pay with PayPal (you don’t need a PayPal account; you can use any credit card) or just print an invoice and submit your payment by snail mail!