Home   /   RESOURCES   /   MYSEC.TV   / Insider Threats and Corporate Data exfiltration

Insider Threats and Corporate Data exfiltration

Tech & Sec Weekly


Jane Lo, Singapore Correspondent speaks with Dagmawi Mulugeta, Threat researcher with Netskope Threat Labs.

Dagmawi has his OSCP and has previously worked at Cyrisk (a subsidiary of 4A Security), Sift Security (acquired by Netskope), and ECFMG as a researcher, security engineer, and developer. He has innate interests in public CTFs, exploit development, and abuse of cloud apps.

He has his MSc in Cybersecurity from Drexel University. In this interview, Dagmawi shared the behavioural insights found for employees preparing to leave, and how these indicators could enable organizations to protect their data more effectively.

He noted the concern that many organisations have with “flight risk” users – that is, employees that are getting ready to leave – taking corporate data with them. A common question to address this concern, is how to efficiently identify such risks – without sifting through hundreds of alerts and spending hundreds of man-hours.

Dagmawi shared how they approached this problem by analysing anonymized data of over 4 million users from more than 200 different organizations worldwide., and some interesting key revelations:

(i) 15% of leavers used personal cloud apps (e.g. Google drive, Gmail) to take data with them
(ii) 2% were violating corporate policy (exfiltrating sensitive corporate information)
(iii) majority of the data movement happens 50 days before leaving. Dagmawi highlighted how they identified three key signals to filter out alerts with potential flight risks:
a) volume – identifying whether the data being moved is anomalous for the individual in the organisation
b) nature of data – whether the data being moved is sensitive
c) direction – whether the cloud application is outside of the organisation’s management (e.g. google drive).

Wrapping up, Dagmawi recommended that encoding the three signals into the detection systems could help reduce the size for reviews by 43x – that is, for every 50 alerts, the signals could help to filter out the 1 or 2 concerning ones.

Recorded 11th May 2023, 3.30pm, Black Hat Asia 2023, Singapore Marina Bay Sands.

#bhasia #mysecuritytv #insiderthreat


May 13, 2024
Ron has been an IT Security professional for over 20 years. He currently leads the strategic vision and coordination for sustaining business resiliency for the Port of Seattle’s Aviation, Maritime, and Corporate cyber functions. Watch Now
May 2, 2024
We speak to Air Vice-Marshal (retd) Cath Roberts AO CSC who has been appointed to the Defence SA Advisory Board and also the Advisory Board with the Andy Thomas Space Foundation. Watch Now
April 29, 2024
We speak with THNG, Chin Hwee, Vice President, Public Safety & Security, ST Engineering and NG Yeow Boon, Deputy Chief Executive (Development), HTX at the inaugural Milipol Asia-Pacific & TechX Summit (MAP-TXS) that took place from 3 to 5 April 2024 at Sands Expo & Convention Centre, Singapore. Watch Now
April 18, 2024
An international team of astronomers has discovered 49 new gas-rich galaxies using the MeerKAT radio telescope in South Africa. Watch Now