5 ms·
Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? That's preci
by munchbunny 6y ago
Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job?
That's precisely the hard question, but I think you can reframe that question: "How can you tell when somebody is accessing data that isn't necessary to do their job, in a given specific case?"
For example, could you correlate access logs to support tickets to make sure a support agent was only accessing sensitive data corresponding to the customer whose ticket they were working on? Could you do that in a mostly transparent way? What if the customer has to explicitly grant access before the agent can open the account for investigation? (None of these ideas are silver bullets, they're all situational possibilities.)
I don't think there are any easy answers, but I do think there's some granularity to how hard any given company finds it reasonable to try to guard against this issue at a behavioral level.
- eternalban 6y agoThis may be a killer app for capability (security) model' approach. The "bored admin" of another comment in this thread has a 'superuser' ACL grant, and would leave auditable traces [if using] a provisionally granted security capability.
- x86_64Ubuntu 6y agoI worked on a HIPAA application years and years ago. I don't think ANYONE was above having their access logged. I'm sure banks have also solved this problem too of no-unauditable access.
- meowface 6y agoOf course. But the question is if a smart, malicious, dedicated insider with a lot of privileges could find some way to access information while evading logging and covering their tracks in other ways.
- munchbunny 6y agoThe answer is definitely yes. Though I feel obligated to add that I think the above fact doesn’t mean an organization shouldn’t try at all to protect against insider threat. Most are opportunistic, not all of the qualities you mentioned. How hard you try depends on your company’s situation. Some industries make it more necessary than others.