“The measure of progress of civilization is the progress of the people.”

– George Bancroft

Sleeping companies lose big from employee, executive fraud http://www.csoonline.com/article/2158625/fraud-prevention/sleeping-companies-lose-big-from-employee-executive-fraud.html

http://www.darkreading.com/vulnerabilities—threats/insider-threats/privileged-use-also-a-state-of-mind-report-finds/d/d-id/1269145?

C-IT Recommendations

  1. Set up a fraud reporting hotline educate employees on the kind of activity considered fraudulent to eliminate any grey areas.
  2. Verify your company has an effective and enforced access control standard and policy which defines roles and baselines for system administrators. Ensure the standard and policy expresses that access should be removed when an employee transfers within the organization or leaves the organization.
    1. Roles should be specifically defined by the needs to perform the duties of the roles and only those duties
    2. Privileged access should granted to the roles and not to the individual users. Individual users should then be added to the roles according to their positions
      1. ex: Database Administrator should not have the rights of the Operating System Administrator
  3. Perform periodic access reviews for privileged account users. Any users or groups who are discovered to have unnecessary access should have privileged access be immediately removed.
  4. Utilize job rotation, and mandatory vacations for all privileged roles. Job rotation allows administrators to
    1. understand that someone else is stepping in to perform the job responsibilities and may be able to detect malicious behavior and consequently deter the administrator’s malicious behavior
  5. Utilize dual control (separation of duties) for highly sensitive activities.
    1. Ex: The individual who makes changes in production source code hand off their changes to someone else for installation control.
    2. This deters malicious behavior as each individual knows an honest employee may detect the behavior

Article Resources

Association of Certified Fraud Examiners 2014 Global Fraud Study

http://www.acfe.com/rttn/docs/2014-report-to-nations.pdf

“Fraud prevention: Improving Internal Controls”

http://www.csoonline.com/article/2127917/fraud-prevention/fraud-prevention–improving-internal-controls.html

Ponemon Institute Privileged User Abuse & The Insider Threat Report

http://www.trustedcs.com/resources/whitepapers/Ponemon-RaytheonPrivilegedUserAbuseResearchReport.pdf

Role Based Access Control (has links to other resources including the “Economic Benefits of Role Based Access Control”)

http://csrc.nist.gov/groups/SNS/rbac/

‘Nemanja’ POS malware compromises 1,500 devices, half a million payment cards, worldwide http://www.scmagazine.com/nemanja-pos-malware-compromises-1500-devices-half-a-million-payment-cards-worldwide/article/348183/

http://www.securityweek.com/most-2013-data-breaches-affected-e-commerce-and-pos-systems-trustwave

C-IT Recommendation

  1. Ensure your organization has Firewalls/Intrusion Prevention Solutions in place that will block incoming attempts to infect PCs.
  2. Ensure your organization has a solid anti-malware solution at the end point and that all endpoints are covered.
  3. Enforce a patch management standard in your organization which requires security patches to be deployed in the production environment within a reasonable time after they are tested within your test environment.
  4. Test business functionality of each type of device and record any issues impacting any business functions on the devices.
  5. If no issues result in the testing, deploy the security updates to the production systems. If functionality impacting issues occur on the test devices, engage vendor support if specific applications are negatively impacted.
  6. Consult with your Vulnerability and Threat Management Team (VTM) to verify all production systems are patched with the latest updates.
  7. Implement an advanced malware solution such as Invincea Freespace, FireEye Web Security (NX Series), Source Fire FireAmp to keep remote connections from initiating from your internal network.

Diluted Freedom Act passes House to privacy advocates’ dismay http://www.scmagazine.com/diluted-freedom-act-passes-house-to-privacy-advocates-dismay/article/348211/

See All 50 Episodes of "C-IT Security Podcast "