Guest Editorial by Venkat Thummisi, Co-founder and CTO, of Inside Out Defense

Just in time for Cybersecurity Awareness Month, the number one threat vector for data breaches needs a closer look: employee access to sensitive data. 

IT departments are becoming increasingly aware of the #1 problem that puts their data at risk, but for which they may not have found a solution. Regardless of the industry sector – healthcare, manufacturing, financial services or transportation – employees interact with third-party vendors and cloud environments more than ever.

It makes it easier for them to do their jobs, but simultaneously, it expands the organization’s attack surface, leaving organizations completely vulnerable.

Just look at the recent data breach headlines involving major companies – casinos, hospitals, banks – no industry or organization is safe from employee data access issues.

(Medical giant HCA Healthcare, which operates 180 hospitals in the U.S. and Britain, reported the personally identifiable information (PII) of about 11 million patients in 20 states may have been stolen in a data breach. Courtesy of WPLG Local 10 and YouTube. Posted on July 11, 2023.)

As the industry continues to explode with new applications, AI technologies, cloud expansion, and companies embracing digital migration, there are several important issues IT teams need to consider when developing their data security posture.

They are as follows:

1. Onboarding systems are very static and work like a ledger. Active Directory/OKTA and others provide birthright privileges to every new user, but they do not account for access privileges added incrementally as the user starts working.

2. Onboarding systems do not have coverage across all the infrastructure and applications. They are limited by those systems and applications connected to them.

3. Access management systems don’t keep track of the number of inactive users who still hold credentials in the system. These inactive credentials are an easy target for external hackers and threat actors, who already know that no one is keeping track of the number of inactive users.

4. Given the lack of visibility across the organization, the residual footprint of users who have left the organization is a major challenge. Third-party users may still have hidden footprints inside the organization even though they are no longer associated with the business.

5. High-privileged users may not need all the access they have. They may have inherited access from former managers whose roles shifted during a merger, leading to them holding an over-privileged level of access they will never use.

6. 

   IT managers don’t have complete visibility of all users. They have visibility when they probe for compliance regularly. But the period between those frequent checkups is the danger zone, as IT departments cannot know if a user is suddenly behaving irregularly, which could signal malicious intent.

7. Stolen keys and credentials, for instance, accessed through a stolen laptop or phone, can easily be used by a hacker because the system will recognize that the user has all the right keys and passwords – but it will not recognize that the user’s behavior and intent is different from what should be expected.

8. The intricate web of interconnected systems and data repositories makes preventing and detecting abuses effectively challenging because you can’t “see” all the systems simultaneously. Nor can you easily follow a user from one platform to another.

9. Once a malicious intruder has been detected, it is often too late to take precautions. When an unauthorized user launches a cyberattack inside your system, that user has been lurking there for a long time and is very aware of how to behave so as not to attract undue attention.

10. Securing your organization’s perimeter with firewalls and zero-trust infrastructure is no longer efficient if many unused credentials are waiting to be exploited. It’s vital to shore up granular security, but it’s not good enough.

The industry is grappling for a solution to all of the above and to help mitigate and stay ahead of any potential for a data breach.

One valuable solution that would immediately address these issues is for IT teams to have real-time visibility into all user activity across all the infrastructure and applications.

Having a catalog of all users – in-office and remote workers – helps IT teams stay on top of employee access to all data streams, whether the CEO or the mail room attendant.

This allows IT to flag questionable behavior or other issues that arise from employee connections.

About the Author

Venkat Thummisi, Co-founder and CTO, of Inside Out Defense, is a product management and engineering leader who has built multiple products in datacenter and Cloud, Threat Intelligence, Security GRC, IOT Security .

Venkat has also been a practitioner in building healthcare Security. He is very passionate about building cybersecurity products operating at scale.

Before Inside Out Defense, he held leadership positions at EMC, RSA, and Schneider. At EMC, Venkat incubated and built data center and cloud products with a market footprint of $2+B.  He was RSA and Schneider’s chief architect of the security product portfolio.  

Venkat earned his Master’s degree in management and engineering from MIT, where he focused on Technology Strategy and Finance, and also completed joint coursework in strategy at Harvard Business School.

Related Technologies…

SIMS Software Nominated for Best Insider Threat Solution in 2023 ‘ASTORS’ Awards

American Security, Today’s Annual ‘ASTORS’ Awards, is the preeminent U.S. Homeland Security Awards Program, and now in its Eighth Year, continues to recognize industry leaders of Physical and Border Security, Cybersecurity, Emergency Preparedness – Management and Response, Law Enforcement, First Responders as well as federal, state and municipal government agencies in the acknowledgment of their outstanding efforts to Keep our Nation Secure.

SIMS Software

Best Insider Threat Solution

• SIMS Insider Threat Tool Management System

• The proliferation of insider threats is a complex and persistent challenge for all national security stakeholders. From the surge in super-malicious personas to simple carelessness on the job, insider threats are pervasive and elusive and are increasing at an alarming rate.

• As the leader of industrial security information management for almost four decades, SIMS Software has elevated insider threat detection into a science, providing a fully automated 360° view of every physical, virtual, and human asset inside a security domain.

• Customers are provided with the technology tools necessary to see the risk landscape, so they can detect, deter, and mitigate insider threats, stay compliant with government requirements, and protect their high-value information and assets.

• Companies often operate in siloed cultures and practices across their organization which may interfere with information sharing, however, SIMS helps to break down those silos to harmonize data and see the patterns for a unique system-of-record for any compliance program where security operations, cyber security, and other functional areas such as HR and Risk Management can work together, share information and track insider threat cases.

• SIMS includes an Insider Threat Utility that empowers organizations to establish proprietary threat models based on their existing data and the risk indicators that matter most to each unique organization, so security professionals can view key metrics across the enterprise, track and catalog cases, view what was reported, investigated, and adjudicated to help the enterprise reduce risk and spot trends.

• From negligent or disgruntled employees to hostile nation-state actors, the costs and consequences of insider threats can be staggering. SIMS Software offers a strategic opportunity to deliver a genuine ROI for businesses, and saves organizations costly expenses by providing security stakeholders the opportunity to deter and mitigate, protect the company brand reputation, and retain customer trust.

• Focused on evolving customer needs and government regulations, SIMS Software combines proven performance, constant innovation, and unmatched customer service to deliver a uniquely powerful security information management system.

SIMS Software 

Best Security Workforce Management Platform

• Security Information Management System

• SIMS Software is the leading provider of industrial security information management software to some of the world’s most renowned government agencies, defense contractors, high technology giants, academic institutions, and research facilities.

• For almost 40 years, the flagship product, Security Information Management System (SIMS), has been the most trusted solution on the market to protect classified and high-value information.

• As the role of a security professional continues to transform with increased responsibilities, evolving compliance requirements, and multifaceted, aggressive threats towards their organization, having a complete solution has never been more imperative.

• SIMS Software provides security professionals with powerful management-level metrics and a 360° view of their organization at their fingertips: reducing data calls, allowing for tracking of assets specific to the organizational requirements, and providing on-demand trend analysis for early detection and insider threat prevention.

• Purpose-built, SIMS provides all the features and functionality necessary to run a powerful, paperless industrial security program with a single system of record, and includes 17 fully integrated modules for a fully automated 360° view of every physical, virtual and human asset inside your security domain.

• SIMS manages visitors, classified contracts, information tracking, and control as well as personnel security clearance monitoring at all levels, and supports all National Industrial Security Operating Manual (NISPOM), Special Access Programs (SAP), and Sensitive Compartmented Information (SCI) requirements.

• SIMS is a robust solution that supports the development costs and interoperability issues associated with in-house developed solutions, which are often more expensive and require in-demand IT resources, and has been designed to meet the hosting needs of all sizes and types of organizations offering both on-prem and cloud hosting options.

• Focused on evolving customer needs and government regulations, SIMS Software combines proven performance, consistent innovation, and unmatched customer service to deliver a uniquely powerful security information management system. By equipping security stakeholders with the tools to protect the lifeblood of their organizations, SIMS Software is proud to play a vital role in advancing the interests of our nation and its allies at home and abroad.

• SIMS provides all the features and functionality necessary to run a powerful, paperless industrial security program with a single system of record, so clients can escape the development costs and interoperability issues associated with in-house solutions.

• SIMS supports all National Industrial Security Operating Manual (NISPOM), Special Access Programs (SAP), and Sensitive Compartmented Information (SCI) requirements, and equips security stakeholders with the tools to protect the lifeblood of their organizations, speed detection, improve accuracy and stay ahead of the threat.

• *SIMS Software is also a Returning Premier Sponsor for their Second Consecutive Year, and was recognized as an ‘ASTORS’ Awards Champion in the 2021 ‘Homeland Security Awards Program.

Learn More…

Major General Walker, USA (Retired) Appointed to SIMS Board of Advisors