You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations
•Download as PPTX, PDF•
0 likes•459 views
This slideshow from this webinar will help insider threat program managers, security officers and others involved in insider threat detection to proactively interview an insider threat and communicate with Human Resources. After this webinar, you will know: How to prepare for an insider threat discussion with an employee or contractor How to provide an insider threat incident rating to determine the correct action How to work with your HR department both before and after an incident You will also walk away with a sample conversation plan and sample questions to ask an insider threat.
More Related Content
Viewers also liked
Viewers also liked (19)
Similar to You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations
Similar to You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations (12)
More from ObserveIT
More from ObserveIT (20)
Recently uploaded
Recently uploaded (20)
You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations
- 1. Doug Sampson, Founder & CEO at Soteritech The Human Side of Insider Threat Investigations Copyright 2016 Soteritech LLC
- 2. ● Assume: Robust Program Installed ● Our Scenario… A Threat is Detected Context
- 3. Dashboard
- 4. Examples ● Repeated access attempts ● Secret discussions at lunch ● Confidential emails sent home ● Cell phone in the SCIF ● Documents to competitors ● Why do people turn? ● So what’s next? A Threat Detected
- 5. ● Notification comes in ● Triage within 10 minutes ● Initial level assigned ● Green (low risk potential, no further investigation needed) ● Yellow (unsure risk potential, needs immediate initial investigation) ● Red (sure risk, needs immediate investigation and action) The Hub
- 6. ● Person’s behavior is deemed normal for his or her job function and responsibility level ● Examples Green
- 7. ● Questionable behavior that deserves further investigation. ● Widest reporting of incidents ● Could be broken down further ● Broad range of ● Communication ● Collection ● Consequence ● Examples Yellow
- 8. ● Behavior unacceptable and against company policy ● Significant information gathering (proof) ● Severe consequences ● Examples Red
- 9. Communicate with certain groups based on severity scale ● Green – maintain internal log ● Yellow – involve HR, IT, Security Office, Legal and Exec (possibly Govt - COTR) depending on level ● Red – involve HR, IT, Legal, Security Office, Exec, COTR (if applicable) and Authorities Hub Communication
- 10. ● Green – none ● Yellow – mild to moderate/intense ● Red – intense/severe Employee Communication
- 11. Know your organization’s policies and stance ● Employee Agreement ● Rules of Behavior ● Handling of Trade Secrets ● Employee Training ● Manager/Exec Training ● Consequences ITPM Responsibility Know Where You Stand
- 12. ● Do Your Homework… Investigate quickly ● Collect data – start case ● Engage with HR, Legal, Finance, IT, Exec-Level ● Possibly… talk to manager/supervisor depending on situation ● Engage the right people, and ● Prepare to have a frank conversation with the employee ITPM Activity
- 13. ● Logistics ● Who to have involved? ● How to prepare? ● What if they go sour? ● What to do? Conversations
- 14. ● Pre-discussion preparations ● Situational awareness ● Discussion Part 1: Accusation ● Discussion Part 2: Consequences ● Successful outcomes ● Un-successful outcomes ● Monitoring Yellow Stage 1 Scenario: Attempting to access unauthorized shared drive folders
- 15. ● Pre-discussion preparations ● Situational awareness ● Discussion Part 1: Accusation ● Discussion Part 2: Consequences ● Successful outcomes ● Un-successful outcomes ● Monitoring Yellow Stage 2 Scenario: Employee overhead talking about the new rocket guidance kit to a fellow employee at a local restaurant
- 16. ● Pre-discussion preparations ● Situational awareness ● Discussion Part 1: Accusation ● Discussion Part 2: Consequences ● Successful outcomes ● Un-successful outcomes ● Monitoring Yellow Stage 3 Scenario: Sending confidentical work emails home
- 17. Yellow Stage 4 Scenario: Getting caught in a SCIF with an unauthorized PED ● Pre-discussion preparations ● Situational awareness ● Discussion Part 1: Accusation ● Discussion Part 2: Consequences ● Successful outcomes ● Un-successful outcomes ● Monitoring
- 18. Yellow Stage 5 Scenario: Being witnessed giving classified documents/hardware/thumb drives to competitors/foreign nationals ● Pre-discussion preparations ● Situational awareness ● Discussion Part 1: Accusation ● Discussion Part 2: Consequences ● Successful outcomes ● Un-successful outcomes ● Monitoring
- 19. ● HUB communications ● Pre-discussion preparations ● Situational awareness ● Discussion Parts 1&2 ● Successful outcomes ● Un-successful outcomes Red Scenario: Leaving the premises with prototype radar sensors
- 20. Conversation Decision Tree Accusation - Are you aware? YesNo Provide Proof – Do you understand consequences? YesNo Explain improvement plan – Do you accept? YesNo Explain unacceptable behavior – Do you accept? YesNo Explain consequences – Do you understand? YesNo Explain improvement plan – Do you accept? YesNo Explain consequences – Do you understand? YesNo
- 22. ● Simulation/Role Play ● Repetition How to Get Better at the Conversation
- 23. Doug Sampson Soteritech, LLC (@soteritech) doug.Sampson@soteritech.com 571-393-3801 Questions David Mai ObserveIT(observeIT.com) david.mai@observeit.com 617-946-0243