Questions tagged [insider-threats]

An insider threat is a malicious hacker (also called a cracker or a black hat) who is an employee or officer of a business, institution, or agency. The term can also apply to an outside person who poses as an employee or officer by obtaining false credentials. The cracker obtains access to the computer systems or networks of the enterprise, and then conducts activities intended to cause harm to the enterprise.

Filter by
Sorted by
Tagged with
0 votes
1 answer
119 views

Port scanning but Windows firewall isn't logging the connection

We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular. Scans always follow the same ...
H3GE's user avatar
  • 1
0 votes
1 answer
88 views

What security controls to guard against malicious Insider Threat Engineers?

In most organisations, there will be watchers who will watch out for insider threats from the employees. e.g., Insider Threat Engineer. But who will watch the watchers themselves in the event they ...
Nathan Aw's user avatar
0 votes
2 answers
139 views

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
moritz1895's user avatar
0 votes
1 answer
198 views

Insider threats vs. insider attacks

I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
Ylvetal's user avatar
56 votes
11 answers
16k views

How to protect my code from “insider” threats when hiring my first employee?

I quit my job to start my own SaaS product. I’m now looking to hire my first employee (another developer). I will be taking appropriate legal precautions to protect my IP, but I’m wondering what other ...
arao6's user avatar
  • 631
3 votes
1 answer
484 views

How to prevent azure pipelines (yaml) from being used as an attack vector?

Let's say the following scenario exists: A git repository exists on Azure DevOps Repos. The repository uses yaml pipelines (azure-pipelines.yml). The repository has branch policies to ensure that ...
myermian's user avatar
  • 131
0 votes
2 answers
1k views

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
secanon's user avatar
  • 13
0 votes
3 answers
215 views

Dealing with an insider threat in an insecure environment

I'm not a security expert by training but I know enough to deal with the occasional breach and how to set up basic practices around SSH keys, passwords, and configuration management in general. I ...
anon-obvi's user avatar
0 votes
1 answer
132 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
user_183231's user avatar
1 vote
1 answer
172 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
adrelanos's user avatar
  • 764
127 votes
8 answers
27k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
d33tah's user avatar
  • 6,544
1 vote
0 answers
98 views

How do Data Leak Prevention (DLP) implemented in Google or Facebook workspace?

I wonder how do Data leak prevention for mitigate insider threat being implemented in mature company/organization, ex. Google, Facebook, Netflix? What tools that are used? How do they have visibility ...
alvin's user avatar
  • 11
3 votes
1 answer
159 views

How should privileged users keep each other in check? [duplicate]

In order to protect systems from insider attacks, companies can apply policies restricting their access. In the case of an employee's termination, the IT department can disable their account before ...
VortixDev's user avatar
  • 435
0 votes
1 answer
189 views

Difference between legitimate file transfer vs data exfiltration of confidential files using FTP

I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer ...
Nicz.cool's user avatar
1 vote
3 answers
315 views

Do large companies storing private user data ensure no single insider can abuse user data? if so, how?

Let's say we have a large company X which stores private user information. For example an e-mail provider, or social network provider. I mainly have GMail and Facebook in mind. So the company has ...
proggie165's user avatar
1 vote
1 answer
645 views

How dangerous are reverse-shells to a network?

I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (...
Inquisitive's user avatar
0 votes
2 answers
210 views

How much is known about who is responsible for all the database breaches?

Troy Hunt claims that those responsible for data breaches are often just teenagers and there are reports that a lot of the breaches would appear to come from insiders. But we also hear a lot about the ...
Peter Gregory's user avatar
0 votes
1 answer
144 views

Locating device/person who is threatening via a hacked email [closed]

At work today, someone of limited integrity has been using a group email address, to send company wide threatening emails. " I am going to sabotage this place... I'm in the building - try to find me.....
brian-welch's user avatar
0 votes
1 answer
122 views

How to filter outgoing traffic?

There are a lot of programs that check incoming traffic for viruses and other malicious software. This is yesterday. Nowadays security means to prevent insider to send information OUT. Are there ...
Dims's user avatar
  • 147
2 votes
2 answers
119 views

Insider's threat to a hosted server

If we buy a VPS, the admin of the enclosing server can always steal our data, right? Is using a dedicated server a solution? (We can't afford our own datacenter in any case.) But it seems that ...
porton's user avatar
  • 185
1 vote
2 answers
166 views

Protecting digital assets from insider threats

Are there any security mechanisms that can protect a company from malicious employees (think database administrators, sysadmins responsible for authentication etc) trying to steal the customer data? ...
aioobe's user avatar
  • 113
1 vote
3 answers
2k views

Can a employee steal a company's SSL certificate private key?

Is it possible to a rogue employee to just login in a company server and steal the private keys used to secure SSL connections? Is it as easy as copying a file? (I've read some questions that the ...
Guest's user avatar
  • 13
57 votes
9 answers
8k views

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

In 2013, a Citibank employee had a bad performance review that ticked him off. The results were devastating: Specifically, at approximately 6:03 p.m. that evening, Brown knowingly transmitted a ...
Nzall's user avatar
  • 7,433
4 votes
1 answer
9k views

How does FireEye HX work? [closed]

Can someone please expand on how FireEye HX works, what does it do exactly? Here is the site info: https://www.fireeye.com/products/hx-endpoint-security-products.html, but it's written in such an ...
boggy's user avatar
  • 211
2 votes
1 answer
2k views

Can cascaded routers protect inner network's machine from attacker from outer network?

Given: Outer Network router A wan ip 209.123.12.11 address 10.10.0.1 machine A address 10.10.0.10 gateway 10.10.0.1 Inner Network router B wan ip 10.10.0.100 address 192.168.10.1 machine B ...
developer.cyrus's user avatar
0 votes
2 answers
133 views

Can I add a new user to an unencrypted Windows installation from a Windows installation disk?

I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to ...
JMK's user avatar
  • 2,506
1 vote
2 answers
301 views

Can I find out if my employer is snooping on me? [duplicate]

I work at a large university and have a computer supplied by my employer. I would like to find out whether my employer is snooping or can snoop on my files or activity on my computer. Can I find that ...
trmdttr's user avatar
  • 111
1 vote
3 answers
683 views

How did Snowden do it? [closed]

We've all read about how Edward Snowden got access to thousands of classified documents and shared them with reporters. But how did he do it? He got access to tons of documents that he was not ...
D.W.'s user avatar
  • 99.5k
4 votes
2 answers
2k views

Attack on Tor with stolen private keys of main nodes

What could attacker do with stolen private keys of main nodes? Tor is based on 10 main nodes: moria1, tor26, dizum, Tonga, etc. IP Addresses of this nodes hard-coded into client. ./src/or/config.c: ...
trankvilezator's user avatar
5 votes
1 answer
304 views

Insider threats for Private Clouds

Any one has any information or pointers to insider threats when cloud platforms like openstack etc deployed within corporate data centers ? What are different kinds of internal threats in general ...
sashank's user avatar
  • 511
10 votes
2 answers
2k views

What is the procedure to follow against a security breach?

Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information. One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
ILikeTacos's user avatar
1 vote
3 answers
3k views

What devices support the permanent addition of an ARP table entry? What tools are available to manage this?

I would like to improve wireless security and certain other on-net security scenarios with a permanent ARP table entry. The idea being that someone on the same subnet or WiFi network will have a more ...
makerofthings7's user avatar
8 votes
6 answers
3k views

How can I secure a network share from the insider threat?

We have a network share that contains thousands of files. I am concerned that anyone with access to the internet could copy that information to a CD. In addition to disabling all removable media, ...
SLY's user avatar
  • 387
9 votes
2 answers
2k views

What security risks do unauthorized mobile hotspot (MiFi) devices on company proprerty pose?

I'm having some difficulty determining how, or if, MiFi devices on property should be regulated. Personally, I see them as having little difference from any other rogue AP in the environment - the ...
Iszi's user avatar
  • 27.1k