Battling Security Threats From Within Your Organization

Imagine a scenario: In a single day, a disgruntled employee downloads sensitive or confidential company documents, announces his or her resignation, and gives the inside scoop to a journalist friend. The revelations hit the headlines, and the company’s legal and public relations teams spend millions trying to repair the company’s tarnished brand.

While you’re busy guarding the perimeter, insiders can cause your business significant damage and financial loss. Whether breaches are caused by malicious individuals or just carelessness on the part of the employee, the 2015 IBM Cyber Security Intelligence Index found that 55 percent of attackers are insiders (nearly half are inadvertent actors).

This report, researched and written by the IBM Managed Security Services Threat Research group, examines the risks posed by individuals inside your organization who have access to proprietary information or sensitive data. What exactly are these insider threats, what types of damage and financial loss can they cause, and what can organizations do to protect themselves?

Read the full research report: Battling Security Threats From Within Your Organization

Michelle Alvarez

Manager, X-Force Strategic Threat Analysis, IBM

Being a good CLR host – Modernizing offensive .NET tradecraft

14 min read - The modern red team is defined by its ability to compromise endpoints and take actions to complete objectives. To achieve the former, many teams implement their own custom command-and-control (C2) or use an open-source option. For the latter, there is a constant stream of post-exploitation tooling being released that takes advantage of various features in Windows, Active Directory and third-party applications. The execution mechanism for this tooling has, for the last several years, relied heavily on executing .NET assemblies in…

Abusing MLOps platforms to compromise ML models and enterprise data lakes

15 min read - For full details on this research, see the X-Force Red whitepaper “Disrupting the Model: Abusing MLOps Platforms to Compromise ML Models and Enterprise Data Lakes”.Machine learning operations (MLOps) platforms are used by enterprises of all sizes to develop, train, deploy and monitor large language models (LLMs) and other foundation models (FMs), as well as the generative AI (gen AI) applications built on top of these models. The rush to leverage AI throughout enterprises has meant that security has been often…

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

2 min read - Summary Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure. Threat Topography Threat Type: Arbitrary File System Read Industries Impacted: Technology, Software, and Web Development Geolocation: Global Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable Overview X-Force Incident Command is monitoring the disclosure…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from X-Force

Being a good CLR host – Modernizing offensive .NET tradecraft

Abusing MLOps platforms to compromise ML models and enterprise data lakes

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

Topic updates