2/ Implement Strong HR Policies
You can’t fully control this element, but your customers’ HR policies can make a huge difference in reducing their insider attack risk. Your job is to persuade them to take these policies seriously.
For starters, they should perform background checks on new hires. Hopefully, they do this already, but make sure to stress the importance of this before they hire someone. Next, they should have a plan in place for employee turnover. When an employee leaves, they should be required to hand over all equipment and keys, and the customer should communicate their departure to you promptly so you can revoke access to important accounts or data. While many employees leave amicably, it only takes one disgruntled former employee to wreck a company’s reputation. Don’t let them take that risk.
3/ Zero Trust
When you start to focus on securing your customers’ networks against insider threats, make sure to implement and police a zero-trust identity policy. The zero-trust identity model claims that access to resources and systems should be denied by default. Only when users meet certain characteristics will they be granted access to specific systems or resources, and only for a limited period of time.
For example, let’s say someone needs to access the accounting database for one of your clients. You could set up the environment so it checks that the user has the proper role in the accounting department, is using a known computer, and is doing so from a known, safe location. If one of those attributes doesn’t check out, the system could prompt the user for more information, such as a temporary code sent via text or email.
4/ Identity Management
Another important part of this plan involves implementing strong identity management and implementing least privilege. When setting up user accounts for your customers, make sure they can access only the data and resources they absolutely need for their jobs. Any additional privileges they have represent considerable risks to the business.
When you first take on a new client, audit their existing users and permissions to make sure no one has more privileges than they need. You may be surprised how often one user ends up with administrator privileges on key systems simply because no one enforced access controls as the company grew. Once you have this audit in place, work on reducing access rights to the minimum needed for employees to do their jobs.
However, this goes beyond initial setup. You have to actively manage user permissions and access. If someone moves departments, you should revoke access to their old systems. For example, if someone from the human resources department switches career paths and joins the marketing team, it would be risky for them to still be able to access sensitive employee information. Remember, if someone doesn’t need access to a resource to do their job, don’t let them.
5/ RMM Checks
Finally, in today’s ever-changing threat landscape, anything that can help you get ahead of the game is hugely important. This is where your existing technology comes into play. Some remote monitoring and management solutions, like SolarWinds® RMM, allow you to create checks to indicate a potential threat.
For example, SolarWinds RMM would let you set up a check for changes to Active Directory that could indicate someone attempting to modify permissions. Or you could set up a check looking for mass file deletions, which could indicate someone attempting to damage important, business-critical information. If your RMM tool alerts you to something like this, then you can respond accordingly.
Conclusion
Unfortunately, employees can and do cause data breaches. As an MSP, you’re responsible for preventing these. So make sure to implement the right steps.
Remember, a well-maintained environment is a secure one.
Marco Muto, Director, Business Development at SolarWind
To find out how the SolarWinds security suite can help you protect your customers, click here
