WE16 - They're People Not Data! The Human Side of Insider Cyberthreats

PUBLIC
Copyright © 2016 Rockwell Automation, Inc. All Rights Reserved. 1
They’re People Not Data!
The Human Side of Insider Cyberthreats
Dawn M. Cappelli, VP and Chief Information Security Officer
Rockwell Automation
Susan Schmitt, Senior Vice President Human Resources
Rockwell Automation

Copyright © 2016 Rockwell Automation, Inc. All Rights Reserved. 2Public
Rockwell Automation Industries
Automotive FoodBeverage Entertainment
Life Sciences Marine Metals
Household &
Personal Care
Fibers &
Textiles
Mining, Minerals
& Cement
Oil & Gas
Power
Generation
Pulp & Paper Tire &
Rubber
Infrastructure
Print &
Publishing
Semiconductor &
Electronics
Water Wastewater

Agenda
 Convince you that insider risk cannot be mitigated unless your team,
processes, and technical tools are people-focused
 Describe how Human Resources (HR) and managers are critical
partners in providing a people-focused approach for Rockwell
Automation’s insider risk program
 Provide practical tips that you can use at your company next week to
start building this type of a people-focused program

Who Are You?

Potential Insider Threat?
https://www.youtube.com/watch?v=6AlqHORFFaE

Essential Participants in an
Insider Risk Program
Human
Resources
IT /
Information
Security
Management
Insider Risk
Team
Legal

What Does Your Insider Risk Program
Look Like?

Are You Stopping Your IP From
Walking Out Your Door?
Symantec, 2013: What's Yours Is Mine: How Employees are Putting Your
Intellectual Property at Risk. http://bit.ly/XFjYwQ

Are You Stopping Your IP from
Walking Out Your Door?
Statistically, half of the people
leaving your company are taking
confidential corporate
information with them!

What You Don’t Know CAN Hurt You!

Focus on the PEOPLE!

Turn Research into a Practical Program

Focus Your Limited Resources
• 50% of insiders who steal IP
do it within 1 month of
leaving the company
• 70% within 2 months
• Over 80% within 3 months
Software Engineering Institute, 2013. Justification of a Pattern for Detecting Intellectual
Property Theft by Departing Insiders: http://repository.cmu.edu/cgi/viewcontent.cgi?
article=1731&context=sei

An Unusual End to a Theft of IP Case!

The Scene of the Attack

The Weapons

Lessons Learned
 CERT’s 90 day window works!
 HR’s role is essential
 Beware of social engineering by insiders, not just outsiders
 Understand and be on the watch for cultural norms
surrounding authority
 Never give up!
 Communicate carefully - especially when there are
language / cultural issues
 Trust but verify

SCADA System –
Insider Cyber Sabotage

Medical System –

Financial System -

A New People Focus –

HR: Your Global Team
If you can educate HR
to understand the
warning patterns of
behavior and
contextual issues,
then they can be your
eyes and ears across
the globe

Sabotage is Critical!

Early Warning of Organizational Risk of Sabotage is
Critical!
If a technical team like IT or
a software engineering
team is under significant
stress, it is important for the
managers to take a step
back and carefully consider
whether they have anyone
exhibiting these behavioral
patterns.

Employee sabotaged his team by shutting down their server …
Rockwell Automation
Insider Cyber Sabotage Case
They had to rebuild all
of their virtual machines
and it cost them 3 days
as they worked on a
tight customer deadline

Get HR and Legal on Board
Work with IT to create
auditing capability
Begin training HR
Your Action Plan –
The Next 3 Months
Build the Foundation

Month 4
Begin a Pilot
REMEMBER
You have a
50/50 chance of
discovering
someone trying
to take
confidential
information
every time you
do
an audit!!

Months 5-6
GO GLOBAL!

Create investigations playbook
Train HR and management on
Automate
Months 7 and Beyond
Mature the Program

Final Thoughts -
The Changing Threat Landscape

Emerging Threat: Arrest of Engineers
Associated with ISIS
Energy Sector Infrastructure SW Development Digital Business
• Engineer working for Indian Oil
Corporation arrested (6/16)
• UK Navy Officer who managed
oil fields for ISIS arrested in
Kuwait (7/16)
• Petroleum engineer from
Britain moved to Syria to work
in oil production for the Islamic
State arrested in Kuwait (7/16)
• Civil engineering dropout
arrested in India (7/16)
• Former Flight Engineer
arrested in Malaysia (5/16)
• Software Engineer – the Amir
of an ISIS cell - arrested in
India (1/16)
• Computer engineer in UAE
arrested (6/16)
• Electronics engineer from
India arrested in Saudi Arabia
(7/16)
• Web designer arrested in India
(1/16)
2
1
4
5
6
7
8
9
3
1
2
4
5
6
7
8
9
3

Change the Perception of Insider Risk
from this…

To This!

Contact Information
Please direct comments and questions to:
Susan Schmitt
Senior Vice President Human Resources
Rockwell Automation
+1 414-382-8113
sjschmitt@ra.rockwell.com
Dawn Cappelli
Vice President and Chief Information Security
Officer
Rockwell Automation
+1 414-323-0404
dmcappelli@ra.rockwell.com

WE16 - They're People Not Data! The Human Side of Insider Cyberthreats

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (20)

Similar to WE16 - They're People Not Data! The Human Side of Insider Cyberthreats

Similar to WE16 - They're People Not Data! The Human Side of Insider Cyberthreats (20)

More from Society of Women Engineers

More from Society of Women Engineers (20)

Recently uploaded

Recently uploaded (20)

WE16 - They're People Not Data! The Human Side of Insider Cyberthreats

Editor's Notes