WE HAVE MOVED - CHECK OUT OUR NEW HOME!

Please hold the line........the caller knows you are waiting and we are trying to connect you........

Thursday 26 May 2011

Young Staff Commit Most Fraud

A new report has revealed that most instances of staff fraud are committed by individuals under the age of 21.

CIFAS – the UK’s Fraud Prevention Service – has released the information in its ‘Staff Fraudscape’ report, which analyses insider fraud.

Insider Fraud Trends

The report also found a 63% increase in cases of staff stealing or disclosing personal data in 2010 compared to 2009. While 29% of staff fraudsters were aged under 21, just 3% were aged between 41 and 50, and none were aged over 50. It was mostly more established members of staff committing the fraud – the average duration of employment before fraud was discovered was five and a half years in 2010.


It is believed that efforts to promote awareness of fraud among employees resulted in a 12% increase in cases being reported by staff in 2010, compared with 2009.


Read some tips on how to protect your business from fraud and how anyone can spot employee fraud.

Read more about the latest CIFAS Staff Fraudscape report.

To report a fraud, call Action Fraud on 0300 123 2040 or use thier online fraud reporting tool.

Tuesday 24 May 2011

"Stuxnet – The Future of Malware"

Click on the above to view
Stephan's presentation

Stephan Freeman is Information Security Manager at the London School of Economics and he recently presented on this subject at the Information Systems Security Association (ISSA) in Dublin.


For further details on Stephan please checkout his very informative blog or follow him on twitter @stephanfreeman


Friday 13 May 2011

Happy Birthday to us…..Happy Birthday to us……….1 Year Old!

Well we have been doing this security blog a year now and Paul and I would like to thank everyone that has supported us during this time.

When we first started out we thought this forum could act as a place for likeminded people to visit, comment and challenge some of the developments that were happening in the security world, or if nothing else gave us the opportunity to share our personal opinion.
We thought if we got a few visits and a little interest it would justify our input and help develop some of our skills. But to date with well over two thousand visits to the blog from all over the world and collectively over 1200 twitter followers of both @chatbacksy and @securityspeak in our first year it’s amazing and definitely surpasses any of our expectations.

We are very keen to use this forum to enable others to share opinion and experience by being a guest blogger and believe we have been successful in bringing the right type and tone of topics by our guests and would like to continue to encourage anyone from the security profession to contact us if they have anything the wish to share and it be published. We are really happy with the positive and constructive feedback we have received and are not surprised to find that some of the topics we have mentioned have not been as well received by a few, (you know who you are) either way we thank you all for your visit.

Anyone who manages a blog will now it is very difficult to keep it fresh, current and with the right amount of content to engage with our followers. Neither of us are Stephen Fry and every once in a while you’ll find a spelling mistake or two but I would like to personally thank my friend and co author Paul for all his attention to the detail. More often than not Paul ends up tidying my attempt at a posting up and certainly keeps the blog the looking fresh and professional in line with our brand. Without his significant help and other guest bloggers the Chatback Security blog could have easily turned into me just ranting every once in a while.

We promise we will continue to try and bring you our opinion on all security related matters and compliment this with what’s going on in the world, but in the meantime Thanks again and Happy Birthday Chatback Security.

Richard

Monday 2 May 2011

The Threat Within


Who is the insider?
But what exactly is the insider threat? What, or rather who, is an insider? Security professionals and government agencies all have their own definitions and all of these that I’ve read differ in their own little way, but fundamentally the meaning is the same.
  
I am not going to quote each and every definition (please use the web links opposite to visit some of the specific sites), but the important thing to remember is that an insider is a person to whom you have given legitimate access to your assets. In my opinion a former employee does not fall into this definition (and so is not an insider) as they no longer have legitimate access. In fact, their activities are likely to constitute a criminal offence in themselves.  

In the counter terrorism arena we talk a lot about capability vs motivation. Terrorists have motivation in buckets but most lack the capability - for example they cannot access the materials to build an effective IED. On the flip-side the insider has the motivation but also the capability as they have the in-depth knowledge of your organisation and the way in which you go about your business.

Companies are understandably slow to come forward and admit about their insider incidents as it could demonstrate a weakness in their internal processes or systems. This weakness could lead to uncomfortable questions from shareholders and governing bodies. The majority of insider incidents are reported by co-workers who experience suspicious activity but many still go undetected.

An Insider can be anyone in your organisation, anyone from the part time cleaner right up to a member of senior management. There is no ‘one size fits all’ profile for the insider, but there are a number of warning signs which could identify that you have a problem (we will cover these in future articles). It is important to remember though that current staff can become an insider, so 'Jim' who has been at his middle management role for 6 years and has a clean record may have a sudden change in personal circumstances (he could fall into financial difficulties) and could become a threat!

There is a massive misunderstanding and a lack of experience when it comes to the insider threat and this stems from no one department taking responsibility for it. The HR department generally deals with pre-employment screening (although in our opinion the security team should), IT systems are taken care of by the IT geeks wearing sci-fi t-shirts and musical ties, and any resulting investigation is dealt with by the security team.

There are various different types of insiders and the threat they pose will be different to each of you but in general they are:
  • Single Action Groups (animal activists or swampy students) – to cause harm, damage or media coverage
  • Terrorists - to cause large scale harm and to maximise media coverage
  • The Lone Wolf - because they want to and can! They are not part of any other group
  • Journalists – to identify an loop hole and to sell more newspapers
  • Foreign Intelligence Service
  • Competitors (corporate espionage) - trying to gain trade secrets, insider trading information or just to gain the upper hand over you
  • Disaffected Staff – revenge for not giving them that promotion/pay rise or someone who thinks they know better then the organisation itself.
  • 3rd Party Facilitation – helping somebody else to gain entry or supplying someone else with the data to commit crime, admin account login/password or giving them your building access card.
  • Unknown Pawns - exploited via various means but one way could be via social engineering or 'water cooler talk'. Normally these types of insider are unaware of the information they are supplying others with.
Why do these people do what they do?

  • Kudos
  • Reward 
  • Personal Mission
  • In the name of Public Interest
  • Identify an issue or wrong doing
  • Revenge
  • Intelligence
  • Facilitation of Crime
The effects of an insider can be far reaching but may include: 

  • Reputational Damage – poor media coverage, loss of investment opportunities
  • Financial Loss – Loss of sales or fines imposed by the ICO or regulating authorities (e.g.: Ofcom or the FSA).
  • Physical Damage
  • Unrest Internally with Staff – potential a lack of trust between staff
  • Loss of Operational Service
  • Loss of IT Service (normally via denial of service attacks)
  • Theft
  • Fraud
  • Poor International Relations
I keep coming back to it, but the single most important factor to consider is that these people have legitimate access, but what does it mean?. For me, this means they have already bypassed the majority of your physical and electronic security measures which protect you. Insiders are placed into organisations for the long term to build your trust, to gain a very in-depth understanding of your processes and the assets they are interested in. Even law enforcement are concerned that people with clean records will join in entry level roles and will raise through the ranks in order to supply serious organised criminals with information to assist them in committing crimes.

There have been numerous incidents of insiders
There are many tools in organisations to prevent these threats and most fall under the security specialism of Personnel Security, some of these are:
  • A robust pre-employment screening regime (most potential insiders can be detected at this stage - especially journalists and people that have clearly lied on application forms or CV’s)
  • Having a staff exit (leavers) procedure
  • Having a positive security culture – where staff are aware of the security risks that your organisation is susceptible to
  • Good policies and procedures, which staff are aware of and read
  • Awareness of the potential warning signs (we will cover some of these in a future articles)
  • Support from the board and senior management
  • A robust security audit process including auditing 3rd party providers (make sure all contracts include a 'right to audit 'clause)
  • Utilising the electronic tools you have in place – system logs, forensic tools etc
Whatever approach you decide for your business, it must be risk-based and targeted. Each organisation’s risk appetite will be different, but one thing for sure is you ‘will’ experience an incident as a direct impact from insider action – it is purely a matter of when, and how significant the impact is.  


The insider threat is a very vast subject and something that is impossible to cover in a single blog post. In my future articles I will give you some more details on this risk but until then expect the unexpected, these people are very difficult to detect but are easier to prevent.