Often the insider cyber threat is understated. It is over simplified with an emphasis on the low level employee and their potential to do harm to the organization. But the cyber threat is more complex and executes among three legs: the employee, the executive, and the information technology environment. How do you respond to the disgruntled employee; the executive that issues edicts; or vulnerability filled software proliferated throughout the cyber infrastructure? How do you respond to the unconvinced; the bean counters, who perceive the threat to be a myth; or those in denial who says, it will not happen to me?

1. The
Lethal
Insider
Threat
Dr.
Emma
Garrison-­‐Alexander
University
of
Maryland
University
College
October
17,
2014

2. THE
INSIDER
THREAT
An
insider
threat
is
generally
defined
as
a
current
or
former
employee,
contractor…
Who
has
or
had
authorized
access
to
an
organizaRon’s
network,
system
or
data…
IntenRonally
misused
that
access
to
negaRvely
affect
the
confidenRality,
integrity,
or
availability
of
the
organizaRon’s
informaRon
or
informaRon
systems…..
To
include
sabotage,
theW,
espionage,
fraud…
Carried
out
through
abusing
access
rights,
theW
of
materials
and
mishandling
of
physical
devices.
CIOs
&
CISOs
Worst
Nightmare
Source:
Na+onal
Center
for
Cybersecurity
and
Communica+ons
Integra+on
Center
(2014).
Comba+ng
the
Inside
Threat.

3. THE
EXECUTIVE
ExecuRves
Are
Deaf,
Make
Them
Listen
HOME
DEPOT
SEPTEMBER
2014
56
MILLION
CUSTOMERS
AFFECTED
TARGET
CORPORATION
DECEMBER
2013
70
MILLION
CUSTOMER
AFFECTED
JP
MORGAN
SEPTEMBER
2014
76
MILLION
CUSTOMERS
AFFECTED
BREACHES
ARE
A
GOOD
THING!

4. THE
EMPLOYEE
CASE
STUDY
–
News
Headlines
–
Douglas
Duchak
“TSA
Worker
Tried
to
Sabotage
Terror
Database”
(Fox
News,
2009)
“TSA
Worker
Gets
2
Years
for
PlanRng
Logic
Bomb
in
Screening
System”
(WIRED,
2011)
“Douglas,
Duchak,
Ex-­‐TSA
Worker,
Gets
2
Years
For
PlanRng
Malware
In
Screening
System”
(Huffington
Post,
2011)
WHAT
YOU
DON’T
KNOW
CAN
HURT
YOU

5. THE
ENVIRONMENT
INFORMATION
TECHNOLOGY
MicrosoW
Releases
October
2014
Security
BulleRn
THE
GOOD,
THE
BAD,
THE
UGLY

6. CYBER
DEFENSE
METHODOLOGY
Desktop
Applica(on
Support
Managed
Services
Basic
Services
Enterprise
Management
Services
Physical
Security
Facility
w
Install
w
Maintenance
Server
w
Storage
w
Pla?orm
Monitoring
w
Power
w
Pipe
Service
Center
w
Asset
Management
People
w
System
w
Interfaces
Structure
w
Environmental
w
Power
S e c u r i t y
Personnel
& Training Policy
IDS
Focused
Operations
Computer
Network
Defense
Network
Intrusion
Detection
Patch
Management
End-Point
Protection
Classification
Management
Vulnerability
Assessments
Key
Focus
Areas
1) Security
OperaRons
Center
2) Network
OperaRons
Center
3) ConRnuous
Monitoring
4) Meta
Data
Management
5) Intrusion
DetecRon
6) Incident
Response
Con(nuous
Monitoring
Meta
Data
Management
• RBAC
• PBAC
• ABAC
Con(nuous
Monitoring

7. “BUILD
IN
SECURITY”
OR
“BUILD
IN
VULNERABILITY”
QUESTIONS???