access to the network, but they also require such access in order to serve their functions. Even one disgruntled person can take revenge and compromise your company. An attacker can steal critical secrets, cause damage to your organization, or put you out of the business. For this, the attacker just needs to find a job opening, prepare a person to pass the interview, have that person hired, and the person will be in the organization. Disgruntled employee A disgruntled employee is an individual who has lost respect and integrity as an employee in an organization. Most of the time, he/she has more knowledge than a script kiddie. Such an individual is ranked a potentially high risk since he/she is an insider and may have more internal knowledge about the organization than any outside attacker. The risk becomes higher if access rights and privileges were also provided to such an individual. Preventing insider threats Insider threats can be prevented by using the following: Separation and rotation of duties Least privilege Controlled access Logging and auditing Legal policies Archiving critical data Common intrusion tactics and strategies for prevention The following are the areas of risks: Phone (help desk): Attackers often use tactics of impersonation and persuasion to gather details of employees. Employees/ help desk should be trained to never reveal passwords or other information by phone. Unauthorized physical access can be prevented using tight badge Building entrance: security, employee training, and security officers. Office: In offices, attackers can use tactics of shoulder surfing. A user should not type passwords if someone else is present. If you have to type a password in someone else presence, type it quickly. All guests should be escorted when they wander through halls searching for open offices. Mail room: Mail room should be locked and monitored in to avoid insertion of forged memos. Machine room/ phone closet: Phone closets, server rooms, etc. should be kept locked every time and inventory on equipment should be kept updated since an attacker can try to gain access, remove equipment, and/or attach a protocol analyzer to obtain the confidential data. Phone and PBX: Overseas and long-distance calls should be controlled so that an attacker cannot steal phone toll access.
access to the network, but they also require such access in order to serve their functions. Even one disgruntled person can take revenge and compromise your company. An attacker can steal critical secrets, cause damage to your organization, or put you out of the business. For this, the attacker just needs to find a job opening, prepare a person to pass the interview, have that person hired, and the person will be in the organization. Disgruntled employee A disgruntled employee is an individual who has lost respect and integrity as an employee in an organization. Most of the time, he/she has more knowledge than a script kiddie. Such an individual is ranked a potentially high risk since he/she is an insider and may have more internal knowledge about the organization than any outside attacker. The risk becomes higher if access rights and privileges were also provided to such an individual. Preventing insider threats Insider threats can be prevented by using the following: Separation and rotation of duties Least privilege Controlled access Logging and auditing Legal policies Archiving critical data Common intrusion tactics and strategies for prevention The following are the areas of risks: Phone (help desk): Attackers often use tactics of impersonation and persuasion to gather details of employees. Employees/ help desk should be trained to never reveal passwords or other information by phone. Building entrance: Unauthorized physical access can be prevented using tight badge security, employee training, and security officers. Office: In offices, attackers can use tactics of shoulder surfing. A user should not type passwords if someone else is present. If you have to type a password in someone else presence, type it quickly. All guests should be escorted when they wander through halls searching for open offices. Mail room: Mail room should be locked and monitored in to avoid insertion of forged memos. Machine room/ phone closet: Phone closets, server rooms, etc. should be kept locked every time and inventory on equipment should be kept updated since an attacker can try to gain access, remove equipment, and/or attach a protocol analyzer to obtain the confidential data. Phone and PBX: Overseas and long-distance calls should be controlled so that an attacker cannot steal phone toll access.
Social%20Engineering.docx