In-Depth

How to Mitigate the Hidden Danger of Modern Storage Security: Insider Threats

As storage environments evolve with hybrid, cloud, and software-defined infrastructure, the risk of insider threats remains one of the most underestimated dangers to enterprise data security

At today's free online tech-ed summit produced by Virtualization & Cloud Review, titled "The Future of Data Storage Security: What Enterprises Need To Know," veteran technology writer and 22-time Microsoft MVP Brien Posey devoted much of his talk to a problem that often hides in plain sight: insider threats.

"There's no one single thing that you can do that's going to shut down insiders. Because, remember, insiders are authorized users. They have access for a reason. They need access in order to do their jobs."

Brien Posey, Freelance Author, 22x Microsoft MVP

As data storage moves deeper into hybrid and cloud models, the same features that make modern storage accessible and efficient can also magnify the damage when trusted users go astray. Posey's session, titled "Next-Gen Storage Protection Tactics," walked attendees through how these threats emerge, how they differ, and how to contain them before they become disasters. The summit is available for on-demand replay.

Understanding the Insider Threat

[Click on image for larger view.](source: Brien Posey).

Posey began his discussion of insider threats by emphasizing that they stem from people who already have legitimate access. He defined it simply: "An insider threat is just a threat that involves use of authorized access, either accidentally or maliciously, in a way that harms the organization and or its data."

He explained that these threats have always existed but are "especially problematic in cloud, first or remote first environments." He grouped them into three types. Malicious insiders are those who "decide that they want to steal your data, maybe for personal use, or maybe to sell that data," or who act out of revenge or other motives. Accidental insiders are employees "who unintentionally cause data breaches or disruptions due to mistakes," and privileged insiders are administrators "who have high level permissions to access these systems" and can cause significant damage. Posey recounted real-world examples of each, from petty sabotage to misconfiguration errors with major consequences.

How Insider Attacks Take Shape

[Click on image for larger view.](source: Brien Posey).

Posey also detailed how insider threats materialize in practice. He described the most frequent outcomes as data exfiltration, data modification, and storage system compromise. Data theft, he said, can happen gradually and quietly: insiders "just download a little bit of data at a time and do it over a really long period of time so that they can escape detection." Modification of data or logs is also common, sometimes used to conceal misconduct or open a door for ransomware.

He noted, "It's not unthinkable that an insider could be paid by someone who wants to access the system to plant ransomware that would open a back door that would give them access." He also warned that well-intentioned collaboration initiatives can create risk when permissions are loosened for convenience: "If you're emphasizing collaboration above anything else, then you're probably giving your employees access to more resources than they would otherwise have access to, and that violates the principle of least privileged access."

Strategies to Mitigate Insider Threats

[Click on image for larger view.](source: Brien Posey).

Posey concluded the section with practical defenses. He stressed that "there's no one single thing that you can do that's going to shut down insiders," since "insiders are authorized users" who legitimately need access. Still, he outlined a series of technical and procedural safeguards to reduce the impact.

First: enforce least-privilege permissions and role separation. "Probably the best thing that you can do is to take full advantage of the access controls that are available to you and to practice the principle of least privileged access," he said. He also advised enabling logging and alerts so "anything that might indicate suspicious or malicious activity automatically generates an alert."

Encryption provides a crucial fallback when insiders have physical access: "If they manage to steal [hardware] and get out the door with it, encryption ... makes the data undecipherable." Finally, Posey emphasized the human layer: background checks ("make sure that this person ... really is who they claim to be"), employee education, incident response plans ("You shouldn't have to stop and think about what to do"), and continuous monitoring to catch anomalies early. "Anything suspicious needs to be looked into," he said, summarizing his multi-layered approach.

And More

Beyond those top topics discussed above, Posey also covered additional areas of next-generation storage security that are explored further in the full replay of his session.

And while replays are convenient--especially for sessions that just concluded--there are clear benefits to attending Virtualization & Cloud Review summits and webcasts live. Attendees can ask questions directly and receive expert insights tailored to their environments (not to mention receive free prizes, in this instance $5 Starbucks gift cards provided by the sponsor, Rubrik, which also presented a session in the summit).

With that in mind, here are some upcoming summits and webcasts from Virtualization & Cloud Review:

For the complete schedule and registration links for all upcoming events, visit the Virtualization & Cloud Review webcasts page.

And our sister publication, RedmondMag, also has a chock-full list of upcoming online events.

About the Author

David Ramel is an editor and writer at Converge 360.

Featured

Most   Popular

Subscribe on YouTube