1. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL Our mission is to help enterprises realize value from their unstructured data. Insider Threats Malice, Mistakes, and Mountain Lions

2. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL2 Where to get the slides http://bit.ly/insiderTHREATS

3. The Varonis Origin Story

4. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL4 Agenda What is an insider breach? Real world breaches: stats and examples Everyday vs headline risks 6 tips for mitigating insider threats

5. The Varonis Origin Story

6. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL6 The Script Get inside (if not there already) Snoop around Exfiltration Get the data out without sounding alarms Enumerate current access; attempt to elevate Visa cards anyone? Usually done by phishing or social engineering PS C:\Users\eddard> findstr /r "^4[0-9]{12}(?:[0-9]{3})?$"

7. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL7 By the Numbers

8. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL8 Privilege Abuse

9. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL9 Our Own Worst Enemy

10. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL10 Snooping Behind the Firewall

11. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL11 Target as a Target $162 million breach Lots of fancy tools watching the perimeter (candy bar syndrome) “[…] spokeswoman, Molly Snyder, says the intruders had gained access to the system by using stolen credentials from a third- party vendor”

12. Risk and Irrational Biases

13. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL13 Fear and Frequency Large university 146,000 student records, including SSNs, exposed Cause? Copy/paste

14. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL14 Focus on Frequency

15. They got in - so now what?

16. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL16 6 Mitigation Tips 1. Eliminate Global Access 2. Eliminate Excessive Permissions 3. Alert on Privilege Escalations 4. Alert on Behavioral Deviations 5. Closely Monitor High-Risk People and Data 6. Setup Honeypots

17. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL17 Tip #1: Eliminate Global Access Locate groups like “Everyone” and “Authenticated Users” and replace them with tighter security groups How do I avoid cutting off legitimate access?

18. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL18 Tip #2: Eliminate Excessive Permissions People and software! Figure out what people have access to but shouldn’t Amazon-like recommendations Auto-expire temporary access Periodically review entitlements

19. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL19 Tip #3: Alert on Privilege Escalations Do you know when someone gets root access?

20. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL20 Tip #4: Alert on Behavioral Deviations Behavioral activity spikes (email, files, access denied) Monitor activity outside of normal business hours

21. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL21 Detecting Ransomware Alert on more than 100 file modify events from a single user in under a minute Alert triggers an action to: Notify IT admins Grab the username and machine Check the machine’s registry for key/value that CryptoLocker creates Get-Item HKCU:\Software\CryptoLocker\Files).GetValueNames() If value exists, disable user automatically: Disable-ADAccount -Identity $actingObject

22. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL22 Tip #5: Setup Honeypots Setup a shared folder that is open to everyone X:\Share\Payroll X:\Share\Confidential X:\Share\CEO See who abuses it

23. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL23 Tip #6: Monitor High Risk People and Data Alert or auto-quarantine sensitive data when it shows up in a public place Watch what root/domain admins are doing

24. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL24 Are you exposed? Free Threat Assessment

25. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL25 Key Findings from Express Assessment Data Risk Assessment Folders with Global Group Access 62% 672 users have non-expiring passwords Stale Data 15,132 Files containing US SSN Data KEY FINDINGS 12,000+ sensitive files with Global Group Access About 79% of all sensitive files 3.51% Folders with inconsistent permissions That is over 14,000 folders in your environment 14% of enabled user accounts are stale 652 Security groups with no users 37,825 Folders that have unresolved SIDs 3.74TB Amount of Stale Data 51,044 Folders contain Stale Data

26. VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL Thank you! Jeff Vogt - Systems Engineer jvogt@varonis.com Kris Krustchinsky – Sales Representative, Corporate kriskr@varonis.com Jae Shin – Sales Representative, State/Local/Edu jshin@varonis.com jvogt@varonis.com kriskr@varonis.com jshin@varonis.com