Short presentation on the definition of an insider, motivations, identification, and combating or preventing the threat.

1. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Presentation Title
Presented By
Dealing with the insider threat.
Matt Lemon
Global Head of Information Security

2. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Introduction:
• Definition of an insider threat.
• Motivations.
• A few statistics.
• Identifying the threat.
• Combatting the threat.
• Preventing the threat.

3. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Quick poll
Which is the bigger risk?
• External attacker
• Organisations own staff
Threat
Internal External
Forrester 2013 - “Understand the State of Data Security and Privacy”

4. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Definition
1. The trusted unwitting insider.
2. The trusted witting insider.
3. The untrusted insider.
A lot is mentioned in the media about the threats of cyberspace, where
outside entities use software flaws, hijacked computers and social engineering
to strike at company networks. For many, insiders are the greater cause for
concern.

5. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Motivation
• Financial Gain
• Career Advancement
• Revenge
• Thrill
• Accidental error
• Being helpful
• Political

6. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Risky areas
• Theft
• Deletion or Corruption of data
• Physical damage
• Data leakage

7. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
How Insiders are handled
Source: 2011 CyberSecuirty Watch Survey, CSO Magazine, U.S. Secret Service, Software Engineering Institute CERT Program at Carnegie Mellon
University and Deloitte, January 2011.

8. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Identifying threats.
FBI Research
Spotting behaviour is difficult
because there is so little and
unhelpful data to work with. Finding
the red flags that predict an insider
threat also gives rise to a lot of false
positives.
Former FBI Chief Information Security Officer Patrick Reidy

9. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Identifying threats
The Insider Threat Cyber “Kill Chain”.

10. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Identifying the threats
• Often first in and last out of the office.
• Lots of unused holiday.
• Changes in lifestyle – Spending, Socializing, Marital Status.
• Resigned.
• Working out redundancy.
• Passed over for promotion or pay review.
• Pending HR disciplinary.

11. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Combatting the threats
Positive Social Engineering.

12. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Combat & Prevention
• Document and enforce policies and controls.
• Include insider threat awareness into security training.
• Monitor and respond to suspicious or disruptive behaviour.
• Anticipate and manage negative issues.
• Know your assets.
• Use strict password and account management policies.
• Enforce separation of duties and least privilege.
• Use access control and monitoring policies on privileged
users.
• Use Security Event and Information Management (SIEM) to
monitor and audit staff.
• Implement secure backup and recovery processes.
• Establish a baseline of normal network behaviour.
• Monitor for potential Data Leakage.

13. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Tools & Techniques
NOT AN ENDORSEMENT – NO AFFILIATION.
• SpectorSoft – Spector 360 (Employee Monitoring Software)
• Tripwire – IP360
• Security Onion - Open Source IDS

14. GRC 2.0 - Breaking Down The Silos
ISACA Ireland Conference – 3
rd
October 2014
Thank you…..
plus.google.com/+matthewlemon/
@mattlemon