topic What are you doing about Insider Threats? in Threats

What are you doing about Insider Threats?

Caute_cautim — Mon, 09 Oct 2023 09:37:45 GMT

Hi All

A very different twist on ransomware from the inside out.

https://www.wired.com/story/tesla-ransomware-insider-hack-attempt/

What is your organisation doing about thwarting this type of threat?

Regards

Caute-Cautim

Re: What are you doing about Insider Threats?

ericgeater — Mon, 31 Aug 2020 15:08:44 GMT

removing administrator privilege from the user at the desktop
ensuring the PCs and storage servers have additional defenses, such as updated antivirus and / or EDR
we're not doing this, but blocking international IP ranges may be useful

I haven't really heard a good defense at the firewall level, other than signature-based detection or anomalous encrypted exfiltration detection

But if a user is privileged enough, and if the data pool is large enough, and the servers are poorly hardened... that is a pickle, ennit?

Re: What are you doing about Insider Threats?

tmekelburg1 — Mon, 31 Aug 2020 15:52:26 GMT

@ericgeater wrote:
we're not doing this, but blocking international IP ranges may be useful

It might be if the C&C server IP is located in another Country. This can get unruly pretty quickly, based on my experience, depending on how many Countries you block/allow. I've had Windows 10 machines try and pull updates from Dublin, Ireland just as an example.

Re: What are you doing about Insider Threats?

Caute_cautim — Sun, 06 Sep 2020 06:08:54 GMT

@ericgeaterIP Reputation or Geolocation blocking may also be useful too.

Regards

Caute_cautim