The Challenges of Insider Misuse

Peter G. Neumann, SRI Computer Science Lab

Prepared for the Workshop on Preventing, Detecting, and Responding to Malicious Insider Misuse
16-18 August 1999, at RAND, Santa Monica, CA

This document is concerned with insider misuse. In particular, it characterizes the challenges of detecting and responding to insider misuse and analyzes how insider misuse differs from penetrations and other forms of misuse by outsiders. It considers primarily malicious insider misuse, but also examines what can correspondingly be done to address accidental insider misuse. It also considers the role of prevention insofar as it affects detection and response capabilities. It incidentally challenges a few of the common default assumptions, although that is only a byproduct of a secondary attempt to put the insider-misuse detection problem into a broader context in order to decompose the overall problem.

This document is organized according to the following questions that it addresses:

1. How does insider misuse differ from outsider misuse?  
    This question is considered with respect to
      1.1. Classes of insiders
      1.2. Classes of insider misuse
      1.3. Threats, vulnerabilities, and risks
      1.4. Exploitations of vulnerabilities
      1.5. Specification of policy for data gathering and monitoring
      1.6. Prevention of insider misuse
      1.7. Detection, analysis, and identification of misuse
      1.8. Desired responses

2. What is a sensible decomposition of the problem of effective
    insider detection and response?
      2.1. Development stages
      2.2. Operational aspects
      2.3. Security implications
      2.4. Anomaly and misuse detection in context
      2.5. Extended profiling including psychological and other factors
      2.6. Responses to detected insider misuse
      2.7. Important observations

3. What needs to be done that is not already being done, in terms of
    short-term and long-term R&D needs?
      3.1. General research and development directions
      3.2. Specific short-term research and development directions
      3.3. Specific long-term research and development directions
      3.4. Hierarchical and distributed correlation in particular

4. What overall conclusions are relevant to insider misuse?

0. MOTIVATION

This document does not need to justify the enormous importance of the insider threat. That should be axiomatic for this audience. Suffice it to say that there are many applications in which there are essentially no outsiders, and all threats necessarily come from people who must be considered to be trusted insiders of one form or another. The recent Los Alamos case, moles, bank fraud, and a long list of abuses by authorized users -- e.g., of IRS, law enforcement, and DMV databases -- speak to applications in which insiders have historically been important concerns in some organizations. Even in applications where outsiders are a problem, insiders may still represent huge risks. It must be remembered that today's COTS operating systems, DBMSs, end-to-end crypto systems, firewalls, and so on are generally not oriented toward preventing insider misuse, and that in many cases differential access controls are either nonexistent or are not used. If commercial multilevel-secure systems existed in the real world with any reasonable assurance, they might retard insider misuse; instead, many systems with sensitive information operate with all users and all information at a single level (``system-high''). Similarly, anomaly and misuse detection cannot prevent insider misuse, and commercial systems typically cannot even detect it. However, that technology needs to be able to detect insider misuse better than what can be done today, and also needs radically improved capabilities for responding accordingly.

=====================================================================

1. HOW DOES INSIDER MISUSE DIFFER FROM OUTSIDER MISUSE?

1.1. Classes of Insiders

The differences among users may involve physical presence and logical presence. For example, there may be logical insiders who are physically outside, and physical insiders who are logically outside. For present purposes, we focus primarily on logical insiders and physical insiders.

Clearly there are different degrees of logical insiders, relative to the nature of the systems and networks involved, the extent to which authentication is enforced, and the exact environment in which a user is operating at the moment. A user may be an insider at one moment and an outsider at another. A user may be also be an insider within one operational frame of reference and an outsider at another.

For example, if a system supports multilevel security (or multilevel integrity, or even some form of multilevel availability or multilevel survivability, as defined in my ARL survivability report at http://www.csl.sri.com/neumann/arl-one.html, .pdf, or .ps), then the presence of compartments suggests that a user can be an insider in one compartment but an outsider in another compartment, or an insider at Top Secret but an outsider with respect to all compartments. In that a user may operate at different levels and compartments at different times, the concept of insider is both temporal and spatial. In some sense, all users of a Top Secret system could be called insiders, although they would appear to be outsiders relative to those others who were cleared into a particular compartment. Thus, everything is relative to the frame of reference -- what the user is trusted to be able to do, what privileges are required, and what data or programs are being referenced, whether the user authentication is strong enough to add credibility to user identities.

With respect to conventional operating systems, database management systems, and applications functioning as single-level systems (even if system high), at one extreme there are ordinary insiders who have passed the login authentication requirements; at the other extreme, there are users who are authorized to become superuser or an equivalent holder of ultraprivileges. However, consider a system in which the superuser privileges have been partitioned starkly and no one user holds all of the privileges, and where the granted privileges are insufficient to gain possession of all other privileges. (The iterative closure of static privileges augmented by privilege-changing privileges must be considered whenever we consider what privileges are actually attainable by a given user or group of collaborating users.) In that rather ideal case, we would have no complete insiders, but many different types of relative insiders. Unfortunately, in the absence of meaningfully secure systems and differential access controls that are properly defined, properly implemented, and properly administered, that ideal must remain more or less of a fantasy.

Thus, we are confronted with a wide potential range of insiders, and conclude that the notion of ``insider'' is necessarily multidimensional. For the rest of Section 1, we consider insiders generically, and do not attempt to make fine nuances among different kinds of insiders. We assume that relative to a particular computational framework, insiders are users who have been authenticated to operate within that framework; where necessary, we qualify that to include reference to the authorized privileges that are associated with a particular authentication. However, in several cases (particularly in Sections 1.2.2, 1.4.2, and 1.7) we make a distinction among insiders -- for example, between ordinary users on one hand and system administrators or other users with extreme privileges on the other hand.

1.2. Classes of Insider Misuse

Along with the range of meanings of the term ``insider'' is associated a variety of classes of insider misuse.

One immediate categorization of insider misuse involves intent, as in intentional versus accidental misuse. Even among intentional misuse, there is a wide range of possible actions -- from outright malice to relatively benign annoyance, with many degrees in between.

A second categorization involves the evidential nature of the misuse, that is, whether the misuse is intended to be detected or hidden. System and network denials of service are likely to be overt, in that they are readily obvious once they are enabled. On the other hand, insertion of stealthy Trojan horses that act as sniffers or that quietly leak information are typically intended to be covert, and their desired purpose may be to remain undetected for long periods.

Although the focus of the Insider Misuse workshop is primarily on intentionally malicious misuse, it is generally unwise to ignore accidental misuse. For example, the apparent success of what might be considered accidental misuse can easily inspire subsequent malicious misuse. Furthermore, it is generally unwise to ignore stealthy forms of misuse. To the extent that detecting accidental misuse can be dealt with by the same mechanisms that are used for intentional misuse, accidental misuse need not be treated separately. To the extent that stealthy misuse can be dealt with by the same mechanisms that are used for more obvious misuse, stealthy misuse need not be treated separately. However, remember that seemingly accidental misuse may in fact be intentional misuse in disguise, and stealthy misuse may be extremely dangerous; thus, it is potentially risky to ignore them altogether.

1.3. Threats, Vulnerabilities, and Risks

There are clearly differences in the nature of the threats. However, it must be remembered throughout that once an apparent outsider succeeds in penetrating a system boundary, he/she effectively becomes an insider from a mechanistic point of view. Although an insider might conceivably have greater knowledge of the environment, and may thereby present greater threats (see Section 1.3.2), the differences between insider threats and outsider threats are not stereotypically characterizable. Because of the very flaky operating system and networking infrastructures today, outsiders have little difficulty in carrying out nasty denial of service attacks and destructive integrity attacks, and in penetrating many systems. Virtual private networks may tend to complicate the situation, and demand special attention. Nevertheless, if a system complex has meaningful authentication, many of the outsider threats can be made much less riskful, whereas most of the insider threats clearly remain. Also, firewalls that are well-designed, well-implemented, and well-configured can help somewhat, but today are also largely vulnerable to many attacks (such as active pass-through attacks using http, Java, Active-X, PostScript, etc.). The presence of meaningful additional authentication for insiders could be useful in inhibiting masquerading (although the use of biometrics is probably premature in noncritical applications). In the presence of extensive monitoring, robust authentication may also help discourage misuse -- especially if the identity of the perpetrator can be established and traced reliably. This may be especially relevant to insider misuse, if the true identity of the apparent user can be unequivocally determined (subject to exploitations of operating-system vulnerabilities).

Insider threats are conceptually different, and it is useful to consider them in their own right. In today's systems, insider vulnerabilities and outsider vulnerabilities are both out of control. Serious efforts are needed to improve security and reliability of system and networks, and indeed to improve the overall survivability in the face of a wide range of adversities. In the presence of good external security, insider risks may be much more serious than outsider risks. In the presence of meaningfully precise access control policies and meaningfully secure differential fine-grained access controls, the nature of the insider misuse threats would change. This document assesses the situation as it exists today, how that situation might change, and what future research is essential to improve both detectability and response.

1.3.1. Threats

The following table itemizes some of the threats that appear to differ from outsiders to insiders. It ignores threats that are common to both outsider and insider perpetrators, such as carrying out personal attacks on individuals or corporations through an anonymous e-mail remailer, sending spams, creating monster viruses from a toolkit, creating risky mobile code, tampering with existing mobile code, intentionally crashing a system or component (although there are potentially mechanistic differences in causing crashes between insiders and outsiders), etc. Once again, remember that an outsider who has successfully penetrated a system has effectively become an insider, although the personal knowledge base may be different. Nevertheless, to simplify the table, penetrating outsiders are logically considered as outsiders unless they are knowledgeable enough to appear indistinguishable in a Turing-test sense from the insiders as whom they are masquerading -- as might be the case with disgruntled recent ex-employees.

----------------------------------------------------------------------
Threats to Various Attributes of Security, According to Misuser Type
----------------------------------------------------------------------
Attribute         Outsiders                 Insiders
---------------   -----------------------   -------------------------
Confidentiality   Unencrypted password      National security leaks
                  capture or compromise     and other disclosures;
                  of encrypted passwords    access to crypto keys
                                             
Integrity         Creating Trojan horses    Putting Trojan horses 
                  in untrusted components,  or trapdoors in trusted
                  Word macro viruses, and   and untrusted components;
                  untrustworthy Web code    x-in-the-middle attacks

Denials of        External net attacks,     Disabling of protected
Service           flooding, physical harm   components, exhaustion of 
                  to exposed equipment      protected resources

Authentication    Penetrations, attacks     Misuse of intended authority
                  on PKI/authentication     by over-authorized users,
                  infrastructures,          usurpation of Superuser,
                  war dialing               access to root keys

Accountability    Masquerading, attacks     Hacking beneath the audit
                  on accounting             trails, altering the logs,
                  infrastructures           compromising misuse 
                                            detection

Other misuses     Planting pirated          Pornography, playing games,
                  software on the Web       running a covert business,
                                            insider trading
----------------------------------------------------------------------

1.3.2. Knowledge Required and Knowledge Used

At least superficially, some differences typically exist in the knowledge available, the knowledge required for various types of misuse or already available without further study, experimentation, or effort, and the knowledge actually used in perpetrating insider misuse. Once again, those outsiders who are Turing-equivalent to insiders (as noted above) are considered as insiders.

For example, insiders might have greater knowledge of what to look for in terms of sensitive information and particularly vulnerable programs in which to plant Trojan horses. In system-high systems, insiders are already likely to be gratuitously granted information to which they do not necessarily need access. In compartmented multilevel-secure systems, users would have to be cleared, although that works both ways: a user not entitled to access a particularly compartment is effectively an outsider with respect to that compartment, and indeed may not even know of the existence of the compartment if the system is properly implemented and operational procedures are properly enforced. But users cleared into that compartment clearly have an enormous advantage over users who are not.

In the following table, we make a distinction among outsiders, ordinary insiders, and privileged insiders such as system administrators (who tend to be totally trusted), recognizing that we are lumping together users with common logical characteristics.

--------------------------------------------------------------
Typical Knowledge Gained and Used According to Misuser Type
--------------------------------------------------------------
Outsiders              Ordinary Insiders   Privileged Insiders
--------------------   -----------------   -------------------
Direct info and        Experience gained   Deep knowledge
inferences from        from normal use     from experience;
web info (such as      and experiments;    normal access to
penetration scripts),  familiarity with    Superuser status;
help files, social     sensitive files,    ability to create
engineering; chats &   project knowledge;  invisible accounts;
BBoards helpful        collusion easy      no collusion needed
--------------------------------------------------------------

There are also differences in how vulnerabilities can be exploited, and the risks that may ensue.

1.4.1. Exploitations of Vulnerabilities

There is a likelihood that an experienced insider can operate very close to normal expected behavior (especially if engaged in a long-term effort at statistical-profile retraining), which would be more difficult to detect. This increases the need for a variety of analysis techniques and correlation (see below).

Today, we have pervasive deficiencies in authentication, operating system security, network security, and intelligently deployed access controls. Given the absurdly poor state of the art in defensive security, the differences between outsider exploitations and insider exploitations may be less relevant than they would be in the presence of good security.

Insider exploitations would become conceptually different in the presence of better system security, but would still present a problem. ⁽³⁾

1.4.2. Potential Risks Resulting from Vulnerabilities

The potential risks may vary significantly from outsiders to ordinary insiders to highly privileged system administrators. However, it is in itself risky to give too much credence to these differences, because of several factors:

• Outsiders who become insiders can potentially wreak havoc similar to that of malicious insiders, although in any particular case the damage could be greater, comparable to, or less.

• Some outsiders such as terrorists may have highly visible major havoc in mind. Other outsiders might try to mask the existence of clandestine Trojan horses, trapdoors, and other system aberrations. In general, exactly the same situation applies to insiders, although the stealthy route would generally be more likely in the presence of strong authentication that hinders insider masquerading and provides a fairly clear chain of evidence. Each type could create highly undetectable effects or massive disasters entailing major risks.

• The weak security of systems, servers, firewalls, and networks implies that outsiders can often do serious damage, whether or not they become insiders.

• Measures of risk are highly speculative, and strongly dependent on the application environment. (One man's feat is another man's poison.)

-----------------------------------------------------------------
           Potential Severity of Risks Incurred
-----------------------------------------------------------------
Outsiders              Ordinary Insiders    Privileged Insiders
--------------------   ------------------   ---------------------
Very serious in        Potentially very     Extremely serious,
badly designed and     serious unless       even with strong
poorly implemented     strong separation    separation of roles,
systems, perhaps less  of roles or MLS;     and MLS levels and
serious with good      system-high systems  compartments; root
user authentication    are inherent risky   privileges risky
-----------------------------------------------------------------

COTS products for misuse detection tend to assume a collection of known vulnerabilities whose outsider exploitations are associated with known policy violations. Existing COTS intrusion-detection products are aimed primarily at penetrators, not at insiders. Policies for insider misuse tend to be strongly application-domain specific, and should dictate what is to be monitored, at what layers of abstraction. Thus, it is essential to have a well-defined policy that either explicitly defines insider misuse, or else a policy that explicitly defines proper behavior and implicitly defines insider misuse by exclusion.

A much better understanding of the application domain is needed for monitoring users for potential insider misuse. Also, more detailed data may need to be collected. Furthermore, when someone is suspected of devious behavior, it may be desirable to go into a fine-grain monitoring mode (such as capturing key-strokes).

Audit trails in existing systems are not necessarily adequate (although Solaris' BSM is more useful than many others). Today, commercial systems for intrusion detection rely on system audit trails, application logs, network packet sniffing, and occasionally physical sensors for their inputs. Similar sources of input data are necessary for detecting insider misuse. In either case, the analysis systems need to obtain some knowledge of the perpetrator if they are to trace the detected misuses back to their initiators. In closed environments, there can be much better user authentication than in open environments, although masquerading is still possible in many operating systems and application environments. Whenever that is the case, the actual choices of data to be gathered for insider-misuse detection could differ somewhat from that of intrusion detection. However, the existence of logical insiders who are physically outside and logical outsiders who are physically inside may make such distinctions undesirable. The necessary use of encryption in highly sensitive systems may also complicate the gathering of information on potential insider misuse.

1.6. Prevention of Insider Misuse

I am a firm believer in prevention where possible and then detection where prevention is not possible. For example, the Multics experience beginning in 1965 (see http://www.multicians.org/) should have taught everyone a lot about the importance and value of prevention -- for example, defining what is meant by security, isolating privileged execution domains from less privileged executions (with 8 rings of protection), isolating one user from another while still permitting controlled sharing (via access control lists), access-checked dynamic linking and revocation, and using some sensible software-engineering concepts.

If there is no meaningful security policy to begin with, then the task of detecting and identifying deviations from that policy is very difficult. If there is no essential prevention in systems and networks, then even if there were a meaningful security policy, it is not possible to implement it. With respect to insiders, any enterprise operating within a system-high approach is inherently implying that there is no such thing as ``insider misuse'' because everything is permitted to all insiders. Thus, to have any hope of detecting insider misuse, we first need to know what constitutes misuse. Ideally, it would then be much better to prevent it rather than to have to detect it after the fact.

1.7. Detection, Analysis, and Identification of Misuse

On the other hand, in the absence of good prevention, it is of course desirable to detect known defined types of misuse (e.g., through rule-based detection) or otherwise unknown types of anomalous misuse (e.g., seemingly significant deviations from expected normal behavior). The latter type of detection could be particularly important in identifying early-warning signs.

Because there are potential differences in the data that may need to be collected, there may be some differences in the approach to detection of misuse among the different types of misuse, depending on the relative roles of insiders and insider misuse. If insiders can exist only within local confines (as in the case of a multilevel security compartment in a system with no remote users), it may be unnecessary to collect packets and other network data -- which itself constitutes a potential security risk. On the other hand, if privileged insiders are also able to access their systems remotely (for example, telnetting from outside) and are in some sense then indistinguishable from outsiders at least geographically or from their external Internet presence, then networking data may also be relevant. Clearly, the presence of strong authentication has an impact on carrying out insider misuse detection.

Similarly, there may be differences in how long input data for an anomaly and misuse platform needs to be retained. If the intent is to gather sufficient information to prosecute insider misusers, then the situation is quite different from insider misuse detection whose aim is to merely detect the presence of misusers so that other extrinsic methods (such as wiretaps, cameras, and physical surveillance) can be invoked. (These differences may also apply to outsiders -- although the relative priorities are likely to be different.) In general, long-term retention of raw audit logs and of digested (analyzed) data is recommended.

The differences in implementation of detection techniques between insider misuse and outsider misuse are not intrinsically different, in the sense that existing techniques can be applied to both. That is, the basic techniques for detection and analysis can be similar in both cases, in that the same mechanisms can generally used for both. However, in that existing COTS analysis systems do not tend to address insider misuse, some new techniques may be useful, particularly for interpretation and response.

• For example, consider signature-based detection tools, such as expert systems. The rules for outsider misuse are generally established based on trying to detect exploitations of known vulnerabilities. The rules for insider misuse must be based on knowledge of what kind of misuse is considered dangerous. These rules must take into account discrepancies between the actual access controls and what kind of access is considered appropriate. Once again, the extent to which explicit differential access controls can be enforced has a direct influence on what kinds of insider misuse need to be detected. However, the same detection tools can be used in both insider and outsider misuse.

• For example, consider profile-based detection tools such as statistical analyzers. The parameters (choice of measures, thresholds, etc.) may be different, but the basic techniques can be the same.

For identification of the intent of the misuse, similar techniques can be useful. However, this is an area where greater research is needed.

As noted above, the COTS marketplace for intrusion detection is aimed primarily at detecting known attacks by outsiders. The idea of rapidly deploying an analysis system is meaningful for a given firewall, or for a given operating system, or for a given application for which a set of rules have already been written. Insider attacks tend to be much more domain specific, and thus the deployment of a system for insider analysis requires some detailed analysis of the threats and risks, some skilled implementation of rules, judicious setting of statistical parameters, and some further work on analysis of the results. This is not a straightforward off-the-shelf installation process. And it is very unwise to talk about intrusion detection in the context of insider misuse. The applicable term should be anomaly and (insider) misuse detection, as we have been very careful to do here. Please make this distinction in general, but especially whenever you are talking about insider misuse!

In a multilevel compartmented system/network environment, in which there are presumably no outsiders (each insider is trusted to operate in certain compartments) and in which the insider threat predominates, monitoring and analysis take on multilevel security implications, with many opportunities for covert channels. Monitoring can be done compartmentally, but aggregation, higher-level or cross-compartment correlation on an enterprise-wide basis present serious potential multilevel security problems. To our knowledge, no COTS products are currently ready for this.

More emphasis is needed on the not-well-known forms of misuse, on interpretation of detected anomalies, and hierarchical and distributed correlation. Much more emphasis is needed on tools to aid in the deployment and configuration of analysis tools for domain-specific applications. Serious effort should also be devoted to multilevel-secure analysis (and response).

1.8. Desired Responses to Detected Anomalies and Misuses

In many cases of outsider attacks (particularly denials of service), it is more important to stave off the attacks than to let them continue. In other cases, it may be appropriate to let the attacks continue but to somehow confine their effects. A similar range of responses exists for insiders. In some cases of insider misuse (particularly where the perpetrator has been identified and prosecution is anticipated), it may be particularly important to detect the misuse, to allow it to continue (perhaps under special system constraints and extended data gathering such as key-stroke capture), and monitor it carefully -- without giving away the fact that detailed surveillance is being done.

Thus, there are clearly differences in the desired responses that may be considered once misuses have been detected. However, the full range of possible responses may also be applicable to both insiders and outsiders -- although possibly in different degrees in the two cases. In any case in which continued misuse is allowed, serious risks exist that undetected contamination may occur and remain subsequently. This must be factored into any dynamic strategies for real-time response to detected misuse.

=====================================================================

2. DECOMPOSITION OF THE PROBLEM

This section looks at insider misuse in the context of the bigger picture of security. It considers the development process (Section 2.1), operational aspects (2.2), security implications (2.3), and the effects of those issues on anomaly and misuse detection (2.4) and response (2.6). It also specifically addresses the importance of user profiling and the desirability of extending it to include psychological factors (2.5).

2.1. Development Stages

• Requirements: Insider threats are often ignored, even in highly sensitive closed systems that tend to run at system high (in the absence of A1 compartmented COTS systems from Microsoft?). Security, reliability, survivability requirements are often short-sighted or left unattended in the subsequent development. COTS intrusion-detection systems have bare-bones requirements.

• Design: Many COTS systems are short-sighted, hindered by their needs for backward compatibility with earlier nonsecure systems and networking, and handicapped by a serious lack of commitment to robust systems. COTS intrusion-detection systems are mostly quick and dirty, looking only at the easy problems.

• Implementation: Many serious security-related implementation flaws persist. As just one example, buffer overflows continue to appear despite years of knowledge of their origins and the ensuing risks.

  Peter G. Neumann, Principal Scientist
  Computer Science Lab, SRI International EL-243
  333 Ravenswood Ave
  Menlo Park CA 94025-3493
    Tel 1-650/859-2375    
    Neumann@CSL.sri.com   http://www.csl.sri.com/neumann/