Microsoft security tools questioned for treating employees as threats
theregister.com
theregister.com
Your network admin has had access to the proxy, and by extension, all your browsing history since forever. Now, your UEBA does that, but mainly just sits there and flags things like a user normally hitting a single host to suddenly hitting 300 hosts on the network, or a user having an average data upload of 500MB/week to 200GB in a single session.
Very few people care if you're using the corporate network to listen to YouTube Music (or even looking for other jobs), most just want to be notified of data exfiltration, compromised accounts, or malicious network activity.
In many jobs, you will be fired on the spot for looking for other jobs
Counterintelligence people definitely view employees as risks. But they're not your boss. They work for a different organization entirely. They're watching your boss, and your boss's boss, too. They only care about threats to national security. If they find other things, they log them, but don't tell your management. They have nothing to do with performance evaluation. The three-letter agencies worked out the rules on this stuff decades ago.
Hernan R Resources, Sam S Upport, etc are the worst ones; the best of them I've pridefully jotted down.
WFH magnifies this attack vector; the internet didn't seem to name it yet, but I'm sure "onboardishing" is gonna be in the annual security training in a few years.
What's the thing that's happening, that you're talking about?
First name, middle initial, last name -> Ian Thomas Support => itsupport@example.com
I haven't found any other examples or mentions of it on the internet since I have seen it in the wild since C0VID, so if anyone has a name better (LLM's didn't) you can be immortalized in Annual Training PowerPoints forever.
Just to test...
After a half hour with Gemini prompt tweaking, I was unable to get it to even repeat those examples verbatim.
Redacted emails - makes sense.
Omitted all connotations and purely asking for expressions resulted in blatant incorrect output.
Completely ignores, redirects, obfuscates, but claims not to be subject nor compliant of U.S.C. 9401(3).
After badgering, it gives blatant false data and forgets context, even if summarized.
Fresh context, purely a word game, and still, nada.
Insults your intelligence for calling out its watchdog LLM.
Gemini was aware of this vector and is U.S.C. 9401(3) compliant.
"Insider threats" are typically the one group that any security firm can actually do anything about in an active manner. Every other threat group comes at you, not the other way around.
https://learn.microsoft.com/en-us/purview/insider-risk-manag...
Having paid attention to cyber security over the past decade, this tracks.
Frankly, the thought of "Actively Coming At" infosec threats is personally appalling.
Feelings aside, you couldn't "actively" "come at" APT actors from the future with unknown techniques, and the way to "actively come at", so to speak, entire categories of "cyber threats" would be to fund detailed white box security testing on your IoT devices or VoIP handsets, for example.
Much cheaper to oppress your workforce. At least that will shorten the checklist. Worst case scenario, you can catch the next wave of offshoring if you push it too far and they unionize.
That's the whole point behind phishing attacks against corporate employees. Back in the day of windows auto-playing CDs and USB files, dropping random official looking drives around the parking lot was a thing: https://www.wired.com/2011/06/the-dropped-drive-hack/
Then you get into data exfiltration by employees who were bribed, etc.
> Forcepoint offers to assess whether employees are in financial distress, show "decreased productivity" or plan to leave the job, how they communicate with colleagues and whether they access "obscene" content or exhibit "negative sentiment" in their conversations.
This far surpasses the normal surveillance, which is more technical in nature. It's trying to combine mind reading and minority report to enforce a Stalinist level of thought control. How much can be delivered in reality remains to be seen, though.
After a while it's a self fulfilling prophecy. All because of a couple of perceived issues.
Looks more like fascism.
https://thediplomat.com/2024/05/fox-in-the-henhouse-the-grow...
If you have 50,000 employees and are screening for a risk that is 1 in 1M with a 5% false positive rate you are going to be very disappointed when over the next decade it identifies 25,000 would be shooters when you have zero actual active shooters. Even better you will probably stop disregarding such a test and miss if if it actually happens.
As awesome the fact that skynet is always watching will probably cause people to manage their workspace personas to a psychotic degree that will surely ratchet up workspace stress to new highs. Deprived of actual data on what triggers the eye of sauron 100 wrong theories about how to avoid doing so will proliferate and your studied population will both diverge from the norm the system was designed to operate on and become progressively worse.
A few years later a study will prove that the AI inadvertently learned to discriminate against minorities, women, or people in other time zones through things the training population did without thinking and the people pushing it will look like bigots. Instead of ejecting we will try to fix it. Either this doesn't work or if it does people accuse skynet of being woke.
Just through personal anecdote, I can think of maybe 5 examples of people I directly know 'retaining' stuff like outlook email PSTs, training documents, etc. And I'm sure there are many more people in my immediate circle who have done similar stuff.
The espionage situation is perhaps more rare, but still prevalent. It's a common situation for people to hang around outside the Foxconn campus soliciting data for the latest iphone / what-have-you. Lots of money to be made have a 2-3 month jumpstart on your competitors when you design a 3rd-party case, for example.
I question the chances it will be any better at catching the fellow who comes back in with the AR than reasonable management.
Insofar as catching people who are simply disloyal I would count it worthless.
At best it might make a bad guess at which employees are presently upset or dissatisfied until it becomes obvious how to fake it by which time it has become easy to guess who hates you because living under the eye of sauron it will be 90% of your staff!