CrowdStrike launches new service to combat insider threats

CrowdStrike has announced the launch of Insider Risk Services, aiming to assist organisations in identifying, preventing, and responding to insider threats that include both negligent employees and sophisticated adversaries.

Insider threats have become a costly issue for organisations, with the average cost reaching USD $16.2 million annually, according to the Ponemon Sullivan Report. This announcement addresses the increasing creativity of threat actors, such as the DPRK-linked group FAMOUS CHOLLIMA, which has infiltrated over 200 U.S. technology companies by masquerading as legitimate employees. This highlights the persistent challenge organisations face with internal security breaches.

The new services from CrowdStrike are designed to bolster defences against these inside risks. With a lack of formal insider risk programs in many organisations, significant gaps remain in security frameworks. CrowdStrike intends to fill these gaps with its comprehensive service offering.

CrowdStrike Insider Risk Services integrates the capabilities of CrowdStrike's Falcon platform with threat intelligence, threat hunting, comprehensive assessments, program reviews, and expert-led incident responses to offer a multilayered defence strategy. Thomas Etheridge, Chief Global Services Officer, said, "Today's insider risks, whether caused by an accident, negligence, or a sophisticated adversary, demand proactive and comprehensive protection to safeguard critical assets and minimize any potential impact."

CrowdStrike's approach recently uncovered methods used by FAMOUS CHOLLIMA. This adversary, linked to the DPRK, has effectively converted legitimate employment opportunities into channels for malicious activity. This case exemplifies the urgent need for robust defences against evolving insider threats.

The key aspects of the Insider Risk Services include performing Insider Risk Program and Technical Reviews which utilise CrowdStrike's intelligence and 24/7 threat hunting to identify vulnerabilities and reinforce security postures. Additionally, Tabletop Exercises and Red Team Simulations are designed to test defences against real-world scenarios and improve detection strategies. Incident Response services aim to swiftly reduce response times, contain threats, and mitigate risks, leveraging adversary-driven intelligence and telemetry.

"With deep adversary insights, extensive experience in countering complex threats and industry-leading visibility and protection provided by the Falcon platform, CrowdStrike Insider Risk Services sets a new standard for combating the modern insider threat," added Etheridge, underscoring the comprehensive nature of the solution.