Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [insider-threats]

An insider threat is a malicious hacker (also called a cracker or a black hat) who is an employee or officer of a business, institution, or agency. The term can also apply to an outside person who poses as an employee or officer by obtaining false credentials. The cracker obtains access to the computer systems or networks of the enterprise, and then conducts activities intended to cause harm to the enterprise.

0
votes
1answer
56 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
1
vote
1answer
68 views

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
117
votes
8answers
19k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
1
vote
0answers
30 views

How do Data Leak Prevention (DLP) implemented in Google or Facebook workspace?

I wonder how do Data leak prevention for mitigate insider threat being implemented in mature company/organization, ex. Google, Facebook, Netflix? What tools that are used? How do they have visibility ...
3
votes
1answer
83 views

How should privileged users keep each other in check? [duplicate]

In order to protect systems from insider attacks, companies can apply policies restricting their access. In the case of an employee's termination, the IT department can disable their account before ...
0
votes
1answer
56 views

Difference between legitimate file transfer vs data exfiltration of confidential files using FTP

I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer ...
1
vote
3answers
182 views

Do large companies storing private user data ensure no single insider can abuse user data? if so, how?

Let's say we have a large company X which stores private user information. For example an e-mail provider, or social network provider. I mainly have GMail and Facebook in mind. So the company has ...
1
vote
1answer
179 views

How dangerous are reverse-shells to a network?

I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (...
0
votes
2answers
141 views

How much is known about who is responsible for all the database breaches?

Troy Hunt claims that those responsible for data breaches are often just teenagers and there are reports that a lot of the breaches would appear to come from insiders. But we also hear a lot about the ...
0
votes
1answer
84 views

Locating device/person who is threatening via a hacked email [closed]

At work today, someone of limited integrity has been using a group email address, to send company wide threatening emails. " I am going to sabotage this place... I'm in the building - try to find me.....
0
votes
1answer
38 views

How to filter outgoing traffic?

There are a lot of programs that check incoming traffic for viruses and other malicious software. This is yesterday. Nowadays security means to prevent insider to send information OUT. Are there ...
3
votes
2answers
59 views

Insider's threat to a hosted server

If we buy a VPS, the admin of the enclosing server can always steal our data, right? Is using a dedicated server a solution? (We can't afford our own datacenter in any case.) But it seems that ...
1
vote
2answers
81 views

Protecting digital assets from insider threats

Are there any security mechanisms that can protect a company from malicious employees (think database administrators, sysadmins responsible for authentication etc) trying to steal the customer data? ...
1
vote
3answers
797 views

Can a employee steal a company's SSL certificate private key?

Is it possible to a rogue employee to just login in a company server and steal the private keys used to secure SSL connections? Is it as easy as copying a file? (I've read some questions that the ...
58
votes
9answers
7k views

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

In 2013, a Citibank employee had a bad performance review that ticked him off. The results were devastating: Specifically, at approximately 6:03 p.m. that evening, Brown knowingly transmitted a ...
4
votes
1answer
5k views

How does FireEye HX work? [closed]

Can someone please expand on how FireEye HX works, what does it do exactly? Here is the site info: https://www.fireeye.com/products/hx-endpoint-security-products.html, but it's written in such an ...
2
votes
1answer
827 views

Can cascaded routers protect inner network's machine from attacker from outer network?

Given: Outer Network router A wan ip 209.123.12.11 address 10.10.0.1 machine A address 10.10.0.10 gateway 10.10.0.1 Inner Network router B wan ip 10.10.0.100 address 192.168.10.1 machine B ...
0
votes
2answers
71 views

Can I add a new user to an unencrypted Windows installation from a Windows installation disk?

I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to ...
1
vote
2answers
211 views

Can I find out if my employer is snooping on me? [duplicate]

I work at a large university and have a computer supplied by my employer. I would like to find out whether my employer is snooping or can snoop on my files or activity on my computer. Can I find that ...
1
vote
3answers
469 views

How did Snowden do it? [closed]

We've all read about how Edward Snowden got access to thousands of classified documents and shared them with reporters. But how did he do it? He got access to tons of documents that he was not ...
4
votes
2answers
2k views

Attack on Tor with stolen private keys of main nodes

What could attacker do with stolen private keys of main nodes? Tor is based on 10 main nodes: moria1, tor26, dizum, Tonga, etc. IP Addresses of this nodes hard-coded into client. ./src/or/config.c: ...
5
votes
1answer
229 views

Insider threats for Private Clouds

Any one has any information or pointers to insider threats when cloud platforms like openstack etc deployed within corporate data centers ? What are different kinds of internal threats in general ...
9
votes
2answers
1k views

What is the procedure to follow against a security breach?

Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information. One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
1
vote
3answers
2k views

What devices support the permanent addition of an ARP table entry? What tools are available to manage this?

I would like to improve wireless security and certain other on-net security scenarios with a permanent ARP table entry. The idea being that someone on the same subnet or WiFi network will have a more ...
8
votes
6answers
2k views

How can I secure a network share from the insider threat?

We have a network share that contains thousands of files. I am concerned that anyone with access to the internet could copy that information to a CD. In addition to disabling all removable media, ...
8
votes
2answers
2k views

What security risks do unauthorized mobile hotspot (MiFi) devices on company proprerty pose?

I'm having some difficulty determining how, or if, MiFi devices on property should be regulated. Personally, I see them as having little difference from any other rogue AP in the environment - the ...