You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

23
Doug Sampson, Founder & CEO at Soteritech The Human Side of Insider Threat Investigations Copyright 2016 Soteritech LLC

Transcript of You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Page 1: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Doug Sampson, Founder & CEO at Soteritech

The Human Side of Insider Threat Investigations

Copyright 2016 Soteritech LLC

Page 2: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Assume: Robust Program Installed● Our Scenario… A Threat is Detected

Context

Page 3: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Dashboard

Page 4: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Examples● Repeated access attempts● Secret discussions at lunch● Confidential emails sent home● Cell phone in the SCIF● Documents to competitors

● Why do people turn?● So what’s next?

A Threat Detected

Page 5: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Notification comes in● Triage within 10 minutes● Initial level assigned

● Green (low risk potential, no further investigation needed)

● Yellow (unsure risk potential, needs immediate initial investigation)

● Red (sure risk, needs immediate investigation and action)

The Hub

Page 6: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Person’s behavior is deemed normal for his or her job function and responsibility level

● Examples

Green

Page 7: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Questionable behavior that deserves further investigation.

● Widest reporting of incidents● Could be broken down further● Broad range of

● Communication● Collection● Consequence

● Examples

Yellow

Page 8: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Behavior unacceptable and against company policy

● Significant information gathering (proof)

● Severe consequences● Examples

Red

Page 9: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Communicate with certain groups based on severity scale● Green – maintain internal log● Yellow – involve HR, IT, Security

Office, Legal and Exec (possibly Govt - COTR) depending on level

● Red – involve HR, IT, Legal, Security Office, Exec, COTR (if applicable) and Authorities

Hub Communication

Page 10: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

●Green – none●Yellow – mild to

moderate/intense●Red – intense/severe

Employee Communication

Page 11: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Know your organization’s policies and stance ● Employee Agreement● Rules of Behavior● Handling of Trade Secrets ● Employee Training● Manager/Exec Training● Consequences

ITPM ResponsibilityKnow Where You Stand

Page 12: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Do Your Homework… Investigate quickly● Collect data – start case● Engage with HR, Legal, Finance, IT, Exec-

Level● Possibly… talk to manager/supervisor

depending on situation

● Engage the right people, and● Prepare to have a frank conversation with the

employee

ITPM Activity

Page 13: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Logistics● Who to have involved?● How to prepare?● What if they go sour?● What to do?

Conversations

Page 14: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Pre-discussion preparations● Situational awareness● Discussion Part 1: Accusation● Discussion Part 2: Consequences● Successful outcomes● Un-successful outcomes● Monitoring

Yellow Stage 1Scenario: Attempting to access unauthorized shared drive folders

Page 15: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Pre-discussion preparations● Situational awareness● Discussion Part 1: Accusation● Discussion Part 2: Consequences● Successful outcomes● Un-successful outcomes● Monitoring

Yellow Stage 2Scenario: Employee overhead talking about the new rocket guidance kit to a fellow employee at a local restaurant

Page 16: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● Pre-discussion preparations● Situational awareness● Discussion Part 1: Accusation● Discussion Part 2: Consequences● Successful outcomes● Un-successful outcomes● Monitoring

Yellow Stage 3Scenario: Sending confidentical work emails home

Page 17: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Yellow Stage 4Scenario: Getting caught in a SCIF with an unauthorized PED

● Pre-discussion preparations● Situational awareness● Discussion Part 1: Accusation● Discussion Part 2: Consequences● Successful outcomes● Un-successful outcomes● Monitoring

Page 18: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Yellow Stage 5Scenario: Being witnessed giving classified documents/hardware/thumb drives to competitors/foreign nationals

● Pre-discussion preparations● Situational awareness● Discussion Part 1: Accusation● Discussion Part 2: Consequences● Successful outcomes● Un-successful outcomes● Monitoring

Page 19: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

● HUB communications● Pre-discussion preparations● Situational awareness● Discussion Parts 1&2● Successful outcomes● Un-successful outcomes

RedScenario: Leaving the premises with prototype radar sensors

Page 20: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Conversation Decision Tree

Accusation -Are you aware?

YesNo

Provide Proof – Do you understand consequences?

YesNo

Explain improvement plan – Do you accept?

YesNo

Explain unacceptable behavior – Do you accept?

YesNo

Explain consequences – Do you understand?

YesNo

Explain improvement plan – Do you accept?

YesNo

Explain consequences – Do you understand?

YesNo

Page 21: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Conversation Plan

Page 22: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

●Simulation/Role Play●Repetition

How to Get Better at the Conversation

Page 23: You've caught an Insider Threat, now what? The Human Side of Insider Threat Investigations

Doug SampsonSoteritech, LLC (@soteritech)

[email protected]

Questions

David MaiObserveIT(observeIT.com)

[email protected]

mailto:[email protected]
mailto:[email protected]

What Makes Interset Different Part 1€¦ · Insider Threat Vs Inside Threat There is a distinction to be made between an ‘insider threat’ and an ‘inside threat.’ An insider

What Makes Interset Different Part 1€¦ · Insider Threat Vs Inside Threat There is a distinction to be made between an ‘insider threat’ and an ‘inside threat.’ An insider

Evolving Insider Threat Detection

Evolving Insider Threat Detection

Insider Threat Detection Recommendations

Insider Threat Detection Recommendations

inSider threat - Bitpipedocs.media.bitpipe.com/.../item_465972/Insider-Threat-Report-2015.pdf · share the insider threat spotlight report 8 Privileged users, such as managers with

inSider threat - Bitpipedocs.media.bitpipe.com/.../item_465972/Insider-Threat-Report-2015.pdf · share the insider threat spotlight report 8 Privileged users, such as managers with

Radicalisation and Insider Threat

Radicalisation and Insider Threat

Managing insider threat

Managing insider threat

Understanding the Insider Threat

Understanding the Insider Threat

INSIDER THREAT VIRTUAL CONFERENCE

INSIDER THREAT VIRTUAL CONFERENCE

Real-world Cases of Insider Threat: Combating Malicious IT ... · The CERT Insider Threat Center The CERT Insider Threat Center is a Center of Insider Threat Expertise at the Software

Real-world Cases of Insider Threat: Combating Malicious IT ... · The CERT Insider Threat Center The CERT Insider Threat Center is a Center of Insider Threat Expertise at the Software

The Insider Threat: Lessons Learned from Actual Insider … · The Insider Threat: Lessons Learned from Actual Insider Attacks Randall Trzeciak Insider Threat Center at CERT ... Public

The Insider Threat: Lessons Learned from Actual Insider … · The Insider Threat: Lessons Learned from Actual Insider Attacks Randall Trzeciak Insider Threat Center at CERT ... Public

Insider Threats - University of Pittsburgh · Unintentional Insider Threat Definition • An unintentional insider threat is (1) a currentAn unintentional insider threat is (1) a

Insider Threats - University of Pittsburgh · Unintentional Insider Threat Definition • An unintentional insider threat is (1) a currentAn unintentional insider threat is (1) a

Insider Threat Summit - The Future of Insider Threat Detection

Insider Threat Summit - The Future of Insider Threat Detection

Insider Threat Experiences

Insider Threat Experiences

Network Security, Incident Management, and Insider … · Network Security, Incident Management, and Insider Threats ... 2. Insider Threat Agenda. ... Insider Threat Issue.

Network Security, Incident Management, and Insider … · Network Security, Incident Management, and Insider Threats ... 2. Insider Threat Agenda. ... Insider Threat Issue.

Insider Threat 2 v1

Insider Threat 2 v1

SureView® Insider Threat

SureView® Insider Threat

Mitigating the Insider Threat

Mitigating the Insider Threat

Insider Threat Working Group

Insider Threat Working Group

Developing Your Insider Threat Program: Insider Threat Best Practices

Developing Your Insider Threat Program: Insider Threat Best Practices

2015 VORMETRIC INSIDER THREAT REPORT · INSIDER THREAT REPORT Trends and Future Directions in Data Security Sponsoring Partners . 2015 Vormetric Insider Threat Report HealthcareRetail

2015 VORMETRIC INSIDER THREAT REPORT · INSIDER THREAT REPORT Trends and Future Directions in Data Security Sponsoring Partners . 2015 Vormetric Insider Threat Report HealthcareRetail