VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL Our mission is to help enterprises realize value from their unstructured data. Insider Threats Malice, Mistakes, and Mountain Lions

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL2 Where to get the slides

The Varonis Origin Story

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL4 Agenda What is an insider breach? Real world breaches: stats and examples Everyday vs headline risks 6 tips for mitigating insider threats

The Varonis Origin Story

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL6 The Script Get inside (if not there already) Snoop around Exfiltration Get the data out without sounding alarms Enumerate current access; attempt to elevate Visa cards anyone? Usually done by phishing or social engineering PS C:\Users\eddard> findstr /r "^4[0-9]{12}(?:[0-9]{3})?$"

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL7 By the Numbers

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL8 Privilege Abuse

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL9 Our Own Worst Enemy

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL10 Snooping Behind the Firewall

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL11 Target as a Target $162 million breach Lots of fancy tools watching the perimeter (candy bar syndrome) “[…] spokeswoman, Molly Snyder, says the intruders had gained access to the system by using stolen credentials from a third- party vendor”

Risk and Irrational Biases

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL13 Fear and Frequency Large university 146,000 student records, including SSNs, exposed Cause? Copy/paste

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL14 Focus on Frequency

They got in - so now what?

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL16 6 Mitigation Tips 1. Eliminate Global Access 2. Eliminate Excessive Permissions 3. Alert on Privilege Escalations 4. Alert on Behavioral Deviations 5. Closely Monitor High-Risk People and Data 6. Setup Honeypots

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL17 Tip #1: Eliminate Global Access Locate groups like “Everyone” and “Authenticated Users” and replace them with tighter security groups How do I avoid cutting off legitimate access?

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL18 Tip #2: Eliminate Excessive Permissions People and software! Figure out what people have access to but shouldn’t Amazon-like recommendations Auto-expire temporary access Periodically review entitlements

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL19 Tip #3: Alert on Privilege Escalations Do you know when someone gets root access?

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL20 Tip #4: Alert on Behavioral Deviations Behavioral activity spikes ( , files, access denied) Monitor activity outside of normal business hours

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL21 Detecting Ransomware Alert on more than 100 file modify events from a single user in under a minute Alert triggers an action to: Notify IT admins Grab the username and machine Check the machine’s registry for key/value that CryptoLocker creates Get-Item HKCU:\Software\CryptoLocker\Files).GetValueNames() If value exists, disable user automatically: Disable-ADAccount -Identity $actingObject

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL22 Tip #5: Setup Honeypots Setup a shared folder that is open to everyone X:\Share\Payroll X:\Share\Confidential X:\Share\CEO See who abuses it

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL23 Tip #6: Monitor High Risk People and Data Alert or auto-quarantine sensitive data when it shows up in a public place Watch what root/domain admins are doing

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL24 Are you exposed? Free Threat Assessment

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL25 Key Findings from Express Assessment Data Risk Assessment Folders with Global Group Access 62% 672 users have non-expiring passwords Stale Data 15,132 Files containing US SSN Data KEY FINDINGS 12,000+ sensitive files with Global Group Access About 79% of all sensitive files 3.51% Folders with inconsistent permissions That is over 14,000 folders in your environment 14% of enabled user accounts are stale 652 Security groups with no users 37,825 Folders that have unresolved SIDs 3.74TB Amount of Stale Data 51,044 Folders contain Stale Data

VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL Thank you! Jeff Vogt - Systems Engineer Kris Krustchinsky – Sales Representative, Corporate Jae Shin – Sales Representative, State/Local/Edu