Reducing data exfiltration by malicious insiders

With careful consideration to business delivery and processes, organisations should put mitigations in place to prevent data exfiltration or limit access to sensitive data in terms of least privilege. Where there is legitimate need, this should be carefully monitored, with an easy way for administrators to manage access controls as employees change roles, and their needs alter. Refer to the NCSC's Cyber Security Design Principles for advice about how to make compromise difficult.

Controlling the use of external storage devices is a major step in mitigating data exfiltration. More information on how to manage this can be found in the NCSC's Device Security Principles. Clear communication of why necessary controls exist can reduce staff frustration at workflow impacts, especially where there is also a realistic ability to perform tasks in line with policy. If prevention is not possible or desirable then the next step is monitoring.

Monitoring may have several purposes including:

• near real-time monitoring to give the user a warning that their action may be risky or breaching policy (for example, a pop-up message warning that an email address is outside the organisation)
• near real time monitoring that allows the organisation to quarantine an action pending human intervention (for example, sending OFFICIAL SENSITIVE material from a government department to an email address that is not @gov.uk)
• post-event monitoring that allows the organisation to identify trends at an individual or group level that may need interventions in order to protect security
• enhanced monitoring for privileged users (often seen as a ‘badge of honour’ within organisations)

Where prevention is not suitable, organisations will want to monitor user activity in a way that is both legal and proportionate. Given the potential volume of data that can be collected, it is useful to have the ability to fine tune monitoring so that it focuses on critical assets, on users of concern (those who have been flagged for enhanced monitoring, e.g. for behaviours or JML process) and on privileged users. Email is a particularly common method for data exfiltration, effective monitoring of email traffic can provide significant mitigations.

A level of staff awareness about the existence of security monitoring is important, with purposes laid out in clear and accessible IT use policies. Staff acceptance of monitoring is more likely when:

• the organisational culture is positive and security monitoring is considered usual practice
• the data is not abused or used beyond the purposes explained to staff

Reminders of the presence of security monitoring can be beneficial in discouraging individuals from malicious insider activity. Since most policy breaches are non-malicious, we recommend you take a constructive approach. This might start with “We’ve noticed you trying to do ‘ABC’, which is unsecure for ‘XYZ’. What issue are you dealing with and how can we help you in resolving it?”.

Irrespective of the prevention and active monitoring controls deployed, organisations need the capability to audit to capture post-event activity relating to users, data, and assets. Auditing effectively provides a backstop when prevention and monitoring are not possible.

Due consideration should be given to who has access to activity logs and the ability to edit them to keep them secure from tampering. Malicious insiders can include long-serving employees with good working knowledge of the organisation's systems. Security monitoring and logging is an in-depth topic, more detailed information on setting it up can be found in the relevant NCSC guidance.

In 2013 Snowden was a technology contractor working in the US National Security Agency (NSA) outpost in Hawaii. He travelled to Hong Kong with reportedly 1.7 million documents stolen from the NSA, 200,000 of which he handed over to investigative journalists almost immediately. Snowden was a user with highly privileged access. He extended that access through social engineering. When his downloading activities attracted attention he convinced colleagues that his activities were part of his job, exploiting procedural differences in Hawaii because of its outpost status. Some reports suggest that he copied his data to flash drives that he smuggled past the guards. Another theory is that Snowden used Command and Control servers to receive encrypted data sessions, authenticating them with self-signed certificates. 

An employee of a UK government agency, between September 2007 and May 2009, legitimately accessed a number of SECRET and TOP SECRET files relating to the work of UK intelligence agencies. He burned copies of the files to DVD and CD which he physically removed, unchecked, from his place of work. He was arrested in August 2009 when he tried to sell them to the Dutch Secret Intelligence Service. Protective monitoring on all IT accounts (particularly those with access to critical assets), rigorous control of removable media and unpredictable entry and exit searches would mitigate this data exfiltration method.

Petraeus resigned as Director of the CIA on 9 November 2012 having had an extra marital affair with his biographer and with whom he improperly shared classified documents. This CIA data breach included the use of online tradecraft involving fake webmail accounts.  On the one hand this showed that he knew that what he was doing was improper, but the data transfers were also unencrypted which showed that he was either reckless or incompetent.  It is not known what monitoring was applied by CIA to Petraeus but seniority should not be a reason for exemption, especially in the case of seniors with access to critical assets (as is often the case). On 23 April 2015 he pleaded guilty to a single charge of unauthorised removal and retention of classified documents, and was sentenced to 2 years’ probation and $100,000 fine. 

A disgruntled employee of a large high street supermarket, deliberately made public the salary information of thousands of employees in 2014. He extracted the information via USB stick. Although he had legitimate access to the information, there were no copying or export controls. He made the disclosure at home using a mobile phone, a fake email address and TOR. The impact was significant, including £2.26m in incident response costs, and the case whether the employer had provided suitable safeguards ended up in the UK Supreme Court.

While stationed in Iraq in 2010, Manning, a junior intelligence analyst, passed hundreds of thousands of battlefield reports and diplomatic cables to Wikileaks. Manning had created a  computer programme to download a large number of files automatically from State and Defense Department databases. Users at the base were also able to download music and computer games and burn them  to CD on the same machines that they used for work. Manning was able to transfer the files by CD to a personal laptop and thence to an SD card for concealed transfer to the US in a camera. 

An unidentified member of staff leaked a policy draft document to a UK national newspaper. The exfiltration method was almost certainly via WhatsApp on their office mobile (which was also used for managing official emails). The department promoted the use of WhatsApp as a secure messaging means but instigated no controls, such as compartmentalisation of mobiles or monitoring/logging endpoints. The investigation involved up to 180 people having had access to the draft in a very short period of time due to shared mailboxes. Strict 'Need to know' measures would have minimised the number of potential leakers, and use of watermarking technologies increased the chances of identification.

In 2017 an engineer who had worked for the aerospace company for 16 years, was imprisoned for attempting to sell sensitive information on US military satellites to Russia. The engineer used USB downloads to steal proprietary trade secrets and other technical data from company IT systems. As well as conducting protective monitoring on all IT accounts, an organisation can reduce the risk of sensitive material being removed by restricting access to critical assets, closing USB ports, increasing unpredictable exit searches, and ensuring their guard force is appropriately trained and motivated. 

The data was collated in the employee’s draft emails under disguised subject headers and was exfiltrated to her contact in 734 WhatsApp messages (subsequently deleted) over a six-month period.  

A large organisation suffered the leakage of sensitive information to the media, provided as internal communication. Attempts to track email distribution were constrained due to different legalisation between jurisdictions. The same organisation faced challenges in retrieving company IT assets. Often staff, particularly contractors, returned to their native counties with corporate IT. Although their accounts should have been locked once IT received notification of their leaving, the assets often contain sensitive information on their local drives. Some contractors considered they owned the IP of work they may have developed whilst supporting the organisation, due to unclear or ignorance to the engagement contract. Controls implemented were geographical limiting IP address ranges, enhancement of JML process making managers responsible for the recovery of assets, media controls and use of encryption of all information (so if exported, difficult to decrypt) as part of a wider DLP solution. They also now provide a process to allow departing staff to legitimately export personal information. 

An organisation discovered very sensitive IP had been hidden within photographs (including personal holiday snaps) and PDFs. When reviewing export controls, it's necessary to ensure suitable technical tools are in place to search for such exfiltration methods, depending upon what applications are permitted on the system in the first place, and the impact of such lost data.

An international organisation undergoing a re-structuring/redundancy programme suffered adverse media attention caused by its staff consultation being made public via MS Teams. Subsequent investigation identified that the meeting invitation had been forwarded directly to the media, but its wider circulation made identification by whom impractical. Subsequently all such invitations contain a traceable unique identifier and a legal confidentially statement is referenced at the beginning of the presentation. It was also identified that documents used within MS Teams presentations were also automatically loaded into OneDrive. Organisations should consider reviewing access control permissions from default of all who are invited to a given meeting. 

An organisation’s head of sales left the company for a similar role with a competitor, despite the individual’s employment contract containing certain constraints. Subsequent check of the individual’s account identified they had downloaded sensitive IP, sales contacts and future portfolio information to an unauthorised USB connected device. The individual had also searched the organisation’s wider resources and emailed ‘internal only’ information to their private email address. The lessons identified was whether the employment contract constraints were legally enforceable and whether the organisation was willing to go to court. Alternative remedies used were gaining a legally binding commitment from the individual that they had deleted the information illegally obtained and a legal letter to their new employer warning that should they make any use of the illegally obtained information, legal action would be considered.