Chapter 2. Inside-Out Attacks: The Attacker Is the Insider

Not only does the popular perimeter-based approach to security provide little risk reduction today, it is in fact contributing to the increased attack surface criminals are using to launch potentially devastating attacks. In general, the perimeter-based approach assumes two types of agents: insiders and outsiders. The outsiders are considered to be untrusted while the insiders are assumed to be extremely trustworthy. This type of approach promotes the development of architectures where networks are segregated into clearly delineated “trusted” zones and “untrusted” zones. The obvious flaw with the perimeter approach is that all the insiders—that is, the employees of a business—are assumed to be fully trustworthy. This chapter will go beyond the obvious and expose how the emerging breed of attackers are able to leverage application and browser flaws to launch “inside-out” attacks, allowing them to assume the role of the trusted insider.

The impact of the attacks illustrated in this chapter can be extremely devastating to businesses that approach security with a perimeter mindset where the insiders are generally trusted with information that is confidential and critical to the organization. Each of these employees in turn becomes a guard to the business’s secrets; it is their vigilance and efforts that will ultimately mean the difference between avoiding an incident and allowing an attacker to steal the organization’s secrets. When any one of the employees makes a poor security decision, such as browsing to a malicious website (even with a fully patched browser), a malicious outsider has an opportunity to latch onto the innocent request and make her way into the organization’s internal network with the insider’s privileges. Similarly, when an outsider convinces, forces, or tricks an employee to click a link, divulge a vital piece of data, or change some seemingly mundane setting, the outsider becomes the insider. When an employee’s browser, email client, or operating system is under an attacker’s control, the outsider becomes the insider.