Identifying and Blocking a 
Rogue Employee on Day One

Concerned about the growing threat from industrial espionage and the value of the IP they managed, the CISO decided to expand the company’s managed security program with Digital Guardian to address advanced, external threats.

Critical Success Factors

• Provide protection from advanced, external threats without impacting performance 
• Fill skill set and resource gaps required to conduct Incident Response (e.g., Forensics and Reverse Engineering).
• Data protection expertise and resources to analyze and correlate events to surface threats immediately
• Integrated reporting with Data Loss Protection for a single management view to threats

The Solution 

With Fortra™’s Digital Guardian® already installed on the company’s endpoints, and configuration, monitoring, and reporting in place from DG’s MSP, adding advanced external threat protection was simply a matter of adding Digital Guardian’s Endpoint Detection and Reponse (EDR) policies to the existing agents’ rule sets. The company could begin to defend against advanced threats immediately. 

On the first day of the policy rollout, Digital Guardian’s Advanced Threat & Analysis Center (ATAC) team alerted the company of suspicious activity. One of Digital Guardian’s 200+ pre-built behavior-based rules identified a backdoor installed on multiple devices logging keyboard strokes, controlling microphones, and recording screen activity. Using DG’s built-in Endpoint Detection and Response Scanner, the ATAC team remotely collected forensic data, including event logs, registry keys, and pertinent forensic artifacts from the affected devices to begin their analysis and build a timeline. 

While the company’s expectation was that advanced threats would originate from outside the company, this attack came from within. The data immediately showed that a business analyst at one of the company’s sites had downloaded multiple hacker tools and technical books on coding. A few months later, the analyst began visiting various hacker and cybersecurity websites. Next, he began testing his skills by running various password dumping programs. He then wrote and installed a backdoor onto his work laptop leveraging the chat client Pidgin for issuing command and control orders, and the FTP protocol to exfiltrate data to a website he managed. 

Digital Guardian’s detailed forensics proved that the analyst installed his backdoor on over 25 devices in the company, collecting video through their laptop camera, recording their daily discussions, and logging their keyboard strokes.