Questions tagged [insider-threats]

An insider threat is a malicious hacker (also called a cracker or a black hat) who is an employee or officer of a business, institution, or agency. The term can also apply to an outside person who poses as an employee or officer by obtaining false credentials. The cracker obtains access to the computer systems or networks of the enterprise, and then conducts activities intended to cause harm to the enterprise.

Filter by
Sorted by
Tagged with
0 votes
1 answer

Port scanning but Windows firewall isn't logging the connection

We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular. Scans always follow the same ...
H3GE's user avatar
  • 1
0 votes
1 answer

What security controls to guard against malicious Insider Threat Engineers?

In most organisations, there will be watchers who will watch out for insider threats from the employees. e.g., Insider Threat Engineer. But who will watch the watchers themselves in the event they ...
Nathan Aw's user avatar
0 votes
2 answers

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
moritz1895's user avatar
0 votes
1 answer

Insider threats vs. insider attacks

I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
Ylvetal's user avatar
56 votes
11 answers

How to protect my code from “insider” threats when hiring my first employee?

I quit my job to start my own SaaS product. I’m now looking to hire my first employee (another developer). I will be taking appropriate legal precautions to protect my IP, but I’m wondering what other ...
arao6's user avatar
  • 631
3 votes
1 answer

How to prevent azure pipelines (yaml) from being used as an attack vector?

Let's say the following scenario exists: A git repository exists on Azure DevOps Repos. The repository uses yaml pipelines (azure-pipelines.yml). The repository has branch policies to ensure that ...
myermian's user avatar
  • 131
0 votes
2 answers

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
secanon's user avatar
  • 13
0 votes
3 answers

Dealing with an insider threat in an insecure environment

I'm not a security expert by training but I know enough to deal with the occasional breach and how to set up basic practices around SSH keys, passwords, and configuration management in general. I ...
anon-obvi's user avatar
0 votes
1 answer

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
user_183231's user avatar
1 vote
1 answer

How to secure a domain name from insider threats, domain hijacking in a corperate context?

Usually there's just one e-mail / e-mail password / domain registrar username / password. And perhaps one 2FA (google authenticator) device and a 2FA recovery code. Either an employee has access to ...
adrelanos's user avatar
  • 744
127 votes
8 answers

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
d33tah's user avatar
  • 6,534
1 vote
0 answers

How do Data Leak Prevention (DLP) implemented in Google or Facebook workspace?

I wonder how do Data leak prevention for mitigate insider threat being implemented in mature company/organization, ex. Google, Facebook, Netflix? What tools that are used? How do they have visibility ...
alvin's user avatar
  • 11
3 votes
1 answer

How should privileged users keep each other in check? [duplicate]

In order to protect systems from insider attacks, companies can apply policies restricting their access. In the case of an employee's termination, the IT department can disable their account before ...
VortixDev's user avatar
  • 425
0 votes
1 answer

Difference between legitimate file transfer vs data exfiltration of confidential files using FTP

I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer ...'s user avatar
1 vote
3 answers

Do large companies storing private user data ensure no single insider can abuse user data? if so, how?

Let's say we have a large company X which stores private user information. For example an e-mail provider, or social network provider. I mainly have GMail and Facebook in mind. So the company has ...
proggie165's user avatar
1 vote
1 answer

How dangerous are reverse-shells to a network?

I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (...
Inquisitive's user avatar
0 votes
2 answers

How much is known about who is responsible for all the database breaches?

Troy Hunt claims that those responsible for data breaches are often just teenagers and there are reports that a lot of the breaches would appear to come from insiders. But we also hear a lot about the ...
Peter Gregory's user avatar
0 votes
1 answer

Locating device/person who is threatening via a hacked email [closed]

At work today, someone of limited integrity has been using a group email address, to send company wide threatening emails. " I am going to sabotage this place... I'm in the building - try to find me.....
brian-welch's user avatar
0 votes
1 answer

How to filter outgoing traffic?

There are a lot of programs that check incoming traffic for viruses and other malicious software. This is yesterday. Nowadays security means to prevent insider to send information OUT. Are there ...
Dims's user avatar
  • 135
2 votes
2 answers

Insider's threat to a hosted server

If we buy a VPS, the admin of the enclosing server can always steal our data, right? Is using a dedicated server a solution? (We can't afford our own datacenter in any case.) But it seems that ...
porton's user avatar
  • 185
1 vote
2 answers

Protecting digital assets from insider threats

Are there any security mechanisms that can protect a company from malicious employees (think database administrators, sysadmins responsible for authentication etc) trying to steal the customer data? ...
aioobe's user avatar
  • 113
1 vote
3 answers

Can a employee steal a company's SSL certificate private key?

Is it possible to a rogue employee to just login in a company server and steal the private keys used to secure SSL connections? Is it as easy as copying a file? (I've read some questions that the ...
Guest's user avatar
  • 13
58 votes
9 answers

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

In 2013, a Citibank employee had a bad performance review that ticked him off. The results were devastating: Specifically, at approximately 6:03 p.m. that evening, Brown knowingly transmitted a ...
Nzall's user avatar
  • 7,393
4 votes
1 answer

How does FireEye HX work? [closed]

Can someone please expand on how FireEye HX works, what does it do exactly? Here is the site info:, but it's written in such an ...
boggy's user avatar
  • 211
2 votes
1 answer

Can cascaded routers protect inner network's machine from attacker from outer network?

Given: Outer Network router A wan ip address machine A address gateway Inner Network router B wan ip address machine B ...
developer.cyrus's user avatar
0 votes
2 answers

Can I add a new user to an unencrypted Windows installation from a Windows installation disk?

I recall hearing this before, the ability to boot up a Windows PC with an unencrypted hard drive using an installation disk/usb, and use the command line utility on the Windows installation disk to ...
JMK's user avatar
  • 2,486
1 vote
2 answers

Can I find out if my employer is snooping on me? [duplicate]

I work at a large university and have a computer supplied by my employer. I would like to find out whether my employer is snooping or can snoop on my files or activity on my computer. Can I find that ...
trmdttr's user avatar
  • 111
1 vote
3 answers

How did Snowden do it? [closed]

We've all read about how Edward Snowden got access to thousands of classified documents and shared them with reporters. But how did he do it? He got access to tons of documents that he was not ...
D.W.'s user avatar
  • 99.3k
4 votes
2 answers

Attack on Tor with stolen private keys of main nodes

What could attacker do with stolen private keys of main nodes? Tor is based on 10 main nodes: moria1, tor26, dizum, Tonga, etc. IP Addresses of this nodes hard-coded into client. ./src/or/config.c: ...
trankvilezator's user avatar
5 votes
1 answer

Insider threats for Private Clouds

Any one has any information or pointers to insider threats when cloud platforms like openstack etc deployed within corporate data centers ? What are different kinds of internal threats in general ...
sashank's user avatar
  • 511
10 votes
2 answers

What is the procedure to follow against a security breach?

Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information. One of them erased all the e-mails from the mail server, sent a massive e-mail to ...
ILikeTacos's user avatar
1 vote
3 answers

What devices support the permanent addition of an ARP table entry? What tools are available to manage this?

I would like to improve wireless security and certain other on-net security scenarios with a permanent ARP table entry. The idea being that someone on the same subnet or WiFi network will have a more ...
makerofthings7's user avatar
8 votes
6 answers

How can I secure a network share from the insider threat?

We have a network share that contains thousands of files. I am concerned that anyone with access to the internet could copy that information to a CD. In addition to disabling all removable media, ...
SLY's user avatar
  • 387
9 votes
2 answers

What security risks do unauthorized mobile hotspot (MiFi) devices on company proprerty pose?

I'm having some difficulty determining how, or if, MiFi devices on property should be regulated. Personally, I see them as having little difference from any other rogue AP in the environment - the ...
Iszi's user avatar
  • 27.1k