Sifting suspicious user behavior to find real threats

Although only a fraction of all cyber activities are suspicious, pinpointing the problem is still a daunting task, a new report found.

In studying 140,000 unique cloud apps, 1 billion files and 10 million users during the month of February, the cloud security firm CloudLock found that 0.02 percent of all user activity is suspicious.

According to the company, just one in 5,000 user activities is suspicious; an organization experiences 5,732 suspicious activities monthly on average; the top offenders exhibit up to 227 times more anomalous activities than average users; and 8 percent of logins fail or get challenged -- 1.3 percent of which originate from risky countries.

CloudLock detected these patterns of user behaviors through a new process – the threat funnel -- for isolating malicious threats from the noise of other potentially suspicious or unusual behaviors. “This is a way to zero in on the huge threats” by studying user behavior, CloudLock’s Ayse Kaya Firat, director of customer insights and analytics, said.

To create the methodology detailed in “The Cloud Threat Funnel: Suspicious User Behavior That Matters," CloudLock looked at all the datasets it collects from its clients. A single organization could use the funnel similarly, however, beginning with collecting all the datasets for its users from an array of sources. Then the data is enriched by, for example, putting extra data points around third-party or malicious IP addresses.

Next, algorithms help the funnel learn users’ normal patterns. “You need to profile users for a certain amount of time and try to understand what is normal based on their past behavior as well as their job function,” Firat said. “Once you establish this pattern, you start distinguishing outliers that are not conforming to patterns that you have identified.” 

When it comes time to focus on anomalies, the dataset has been whittled down to information that is interesting but still not indicative of a true threat, Firat explained. Organizations need to distill it further by correlating the activity with other information, such as access control policies. For example, a user who is downloading millions of datasets for the first time or trying to access sensitive assets would raise a red flag, she said.

The last step in the funnel is to use an adaptive self-learning model that learns from past behaviors. At that point, she said, “you start reducing the number of alerts in the data to find the real signal in the noise.”

In other words, the funnel learns about activities, and the next time data goes through the review, the funnel studies it differently.

Other findings from the report include:

• The top offenders delete 141 times more documents than the average user in a given month.
• 99.6 percent of users log in to corporate cloud platforms from one or two countries per week, but one in 20,000 signs in from six or more countries. Some user accounts showed logins from 68 countries, which is virtually impossible for a legitimate user to do.
• Of the 5,732 monthly suspicious behaviors, 58 percent are abnormal.
• Eleven percent of suspicious activities are administrator actions.

The threat funnel might produce different results for government agencies than for private entities, CloudLock suggested, because the government follows more security standards and mandates, such as the Federal Information Security Management Act and the Federal Risk and Authorization Management Program. “Across all industries, it seems government would have the most stringent defenses against data exposures,” CloudLock stated in its “Riskiest Industries in the Cloud” report.

“This is in line with our findings,” Firat said. “But, there’s still great power in focusing on the top 1 percent of users, as they are responsible for 73 percent of organizationwide exposures, and 80 percent of public exposures. ... By eliminating risk in that small subset of users, government agencies can easily bring the rate of exposure much closer to the goal of zero.”

Because a security breach in government is extremely serious, agencies should focus on excessive sharing and account compromises. Most important, however is uncovering the source of the breach at “the speed of light,” Firat said.

To illustrate how the threat funnel would work for a government agency, Firat used the example of the data breaches at the Office of Personnel Management that put more than 21 million records at risk. The cause was a compromised account that allowed a hacker to use valid credentials to access the information. “This [attack] probably has included lots of data downloads, login failures, login challenges for this valid credentials test,” she said. If the threat funnel was being used, “that specific account compromise might have been detected.”

Agencies must use government security requirements to make the case deploying better technology rather than look at them as a hassle, Firat said, because the latest approaches are what will help keep government information safe.

 “The adversaries out there are getting more sophisticated,” she said. “If you want to be able to pinpoint the account compromises – the real suspicious behaviors – quickly, you need to adopt a model where you can predict, prevent and detect these adversaries and respond to them quickly with a structured process.”