97 Things Every Information Security Professional Should Know

Chapter 19. Insiders Don’t Care for Controls

Damian Finol

Putting together security infrastructure and controls around your assets, data, and employees is an insurmountable task. Many CISOs (chief information security officers) go through a shopping list to check out boxes: next-gen firewalls, SIEMs (security information and event management), endpoint management, HSMs/keystores, etc.; they believe that good security means deploying “basic” controls to cover your business against attackers and then calling it a day.

Insiders however, care little for these controls. A firewall? Well, they’re already inside your network. Keystores? Useless when they already have access to systems. SIEMs? What if they can become a superuser of that collector? In short, insiders care little for your controls and have everything to gain from taking advantage of the usual InfoSec paradigm of stacking them mainly to prevent external attackers.

Truth be told, external attackers are no different from internal threats once they have gone past your defense systems. Most of the time these attackers either compromise an internal user account, or a role account, and from there, every action they take is within the parameters defined by the organization of what that employee can do. Access sensitive customer data? No problem. Perusing your source code? Not a problem either.

So, the true ant work in InfoSec comes ...