Tenable Blog

Data breaches associated with “insiders” – individuals considered trusted entities and granted privileged access to internal systems and data – are not the most common type of IT breach, but are one of the most costly with an estimated cost of over $400,000 per incident and an average victim loss of $15 Million/year¹. The problem is so impactful that the FBI has a separate webpage dedicated to the topic.

One of the inherent qualities of malware is the ability to hide from the system and the user. It is in the best interest of the bad guys to not be detected, and various forms of malware implement different methods of hiding. However, one method that is very scary is the ability to hide inside the components of the PC, rather than in the operating system. This is the case with malware targeting the BIOS or the unified extensible firmware interface (UEFI) in more modern computers. The dangers is that software running in this area of the system can gain full control of any functions (such as all connected hardware) and bypass protections put in place by the operating system. It makes detection extremely difficult and will persist across system restores and rebuilds.

Privileged users are a fact of life, but they pose an expanding opportunity to adversaries in the new IT landscape. There are two classes of privileged users on your network today: the users of your cloud-based applications such as SalesForce and NetSuite, and your system administrators. Any adversary who is able to compromise a desktop, laptop or mobile device of one of these users has unfettered access to your data.

Tenable delivers update to SecurityCenter CV’s Log Correlation Engine, making it easier to integrate Continuous Monitoring in your IT infrastructure.

The landscape of IT security is changing and the rash of recent data breaches has targeted a fatal flaw in the way organizations have approached security over the last two decades. When it comes to security practices, organizations are going to have to adapt: older techniques simply won’t cut it anymore.

Defensive technologies like firewalls, antivirus, patching systems and security event management have failed to prevent successful attacks because they are frequently not aligned with a unified security policy or business practice.