In order to put a face on the depth and breadth of potential insiders that can be found throughout your enterprise, I will introduce you to three insider villains and three insider heroes. Each villain will represent one of the key misuse of privileges and each hero will represent key values delivered by least privilege. This fifth introduction will be of the craftiest villain.
Indirect misuse of privilege is the hardest misuse of privilege to spot inside your perimeter. Why? Because when an outsider succeeds in impersonating some trusted insider of your organization and is executing commands from the that set of credentials, you think it is actually valid. To better examine this type of privilege misuse I’d like to introduce you to “Identity Thief Irene.”
Irene is the worst villain of them all; she is an outsider who has hijacked the credentials of an unsuspecting over-privileged insider and uses those credentials to steal, modify or delete data and/or plant malware.
Indirect misuse of privileges is when one or more attack types are launched from a third party computer that has been taken over remotely. A startling statistic revealed by Gartner is that 67% of all malware detections ever made were detected in 2008. Gartner also estimates managed desktops, or users who run without admin rights, produce on average a $1,237 savings per desktop and reduce the amount of IT labor for technical support by 24%.
