Building A Holistic and Risk-Based Insider Threat Program An Approach to Preventing, Detecting and Responding to Insider Threats

Craig Astrich

March 2015

Insider Threat Defined

- 3 - Insi

der_

Thre

at_P

rese

ntat

ion.

pptx

Insider Threat Types & Drivers Insider threats include a wide rage of acts that can impact an organization's brand, reputation, financial standing, and national security.

Insider Threats

Physical Property Theft Use of insider access to steal material items (e.g., goods,

equipment, badges)

Espionage Use of access to obtain sensitive info for exploitation that impacts

national or corporate security and public safety

Workplace Violence Use of violence or threats of

violence to influence others and impact the health and safety of the

an organization’s workforce

Security Compromise Use of access to facilitate and

override security countermeasures (e.g. drug and contraband

smuggling)

Terrorism Use of access to commit or

facilitate an act of violence as a means of disruption or coercion for

political purposes

Information Theft Use of insider access to steal or

exploit information

Sabotage Intentional destruction of

equipment or IT to direct specific harm (e.g., inserting malicious

code)

Other Captures the evolving threat

landscape including emerging threats not covered in the previous

examples

Ignorance

Lack of awareness of policies and procedures creates risk

• Employees being uninformed of polices and procedures or changes in in protocol is a challenge to CBP particularly when dealing with emerging threats and new employees

• Lack of understanding and experience with security protocols and the potential impact if not followed, further contributes to the likelihood

Complacency

Lax approach to policies, procedures, and potential information security risks

• Over time employees may become more lax about security policies and procedures

• Violators often assume that their specific behavior doesn’t have a noticeable impact or that no one is monitoring their behavior. Includes passive aggressive behavior in the face of work frustration and feeling under valued

Insider Threat Drivers

Malicious Intent

An act that is malicious and intentional and done to cause damage

• Employees that are triggered by a specific work-related or non-work-related incident such as a poor performance review, personal crisis, or shift in ideology or loyalty follow a path of idea to action

• Insiders typically develop a plan in advance that someone within the organization may detect

Building A Holistic and Risk-Based Program

- 5 - Insi

der_

Thre

at_P

rese

ntat

ion.

pptx

Insider Threat – Program Structure The insider threat program structure includes the routine engagement of stakeholders that sit on an insider threat working group, foundational building blocks that are likely in place within the organization and the use of an advanced analytics solution.

Stakeholders • Multidisciplinary groups will coordinate and

provide input and meet on a reoccurring basis

Low

High

Pre-employment Investigations &

Procedures

Security Education and

Awareness

Personnel Management

Security Capabilities

Termination Procedures

Physical Security Access

IT Security Access and Technical

Controls

Non-Virtual Indicators

(Complaints, Investigations, Foreign Travel,

etc.)

Contextual Descriptors

(Access, Security

Clearance)

Virtual Indicators

Data Analysis & Reporting with

Advanced Analytics Tool

Program Foundation • Security policies, procedures and technology

provide the foundation for mitigating insider threat • Vetting, managing, and releasing personnel properly

and safeguarding data and information in systems

Access and Technical Controls • Serve as barriers to entry for personnel and require continued

re-evaluation of necessary access

• In the event of an incident, resilience (e.g., system and data back-up and recovery procedures) is critical

Individual Monitoring • Aggregating data from disparate but related data sources provides

improved insight into the risk profiles of individual employees

• Types of data collected will include PII and must be safeguarded to the fullest extent; access to this security information will be limited

Data Analysis & Reporting • Data from disparate sources is combined to identify individual employees at-risk

• Advanced analytics tool provides automated analysis and reporting based on a risk algorithm that aligns with the organization’s risk tolerance

Active Monitoring* Key

Insider Threat Program Components

Data Elements Monitored

Data Analytics Capability

* Creates proactive awareness and potential for cross-disciplinary coordination, intervention, and resolution.

Human Resources

Policy Coordination

Office of General Counsel

Information Technology

Insider Threat Program Stakeholders

Based on factors such as virtual and non-virtual

actions coupled with contextual descriptors

risk mitigation efforts will focus on individuals

perceived to be at an elevated risk

Finance and Administration

Security Operations

- 6 - Insi

der_

Thre

at_P

rese

ntat

ion.

pptx

Insider Threat Definition and Vulnerability Assessment Framework Four key components provide a framework for evaluating an organization’s overarching ability to prevent, detect, and mitigate Insider Threats. Use of these four components creates a holistic framework to examine Insider Threat vulnerabilities and to prioritize high risk areas.

Employee Lifecycle and Security Management Information Access and Technical Controls

Role-based access, continuous monitoring programs, and Insider Threat-related network controls provide prevention and detection capabilities.

Procedures associated with the recruitment, vetting, hiring, resignation, termination, and transfer procedures throughout the employee lifecycle.

Risk Indicators Policies and Training

Non-technical controls and trainings that govern the mitigation of Insider Threats, set expectations, and ensure consistent enforcement.

Insider Threats are influenced by a combination of virtual, non-virtual, and organizational factors. An individual’s behavior across each landscape must be evaluated and weighted based on the drivers of risk.

The framework provides an approach to evaluate and develop a holistic and risk-based insider threat program that focuses on prevention, detection and response.

- 7 - Insi

der_

Thre

at_P

rese

ntat

ion.

pptx

Insider Threat – Cyber as a tool for detection

- 8 - Insi

der_

Thre

at_P

rese

ntat

ion.

pptx

Common Findings

Insider Threat Program

Foundation

Proactive Threat Detection

Insider Threat Training and Awareness

Data Exfiltration Methods

Insider Threat Controls

The organization does not collect and correlate technical and non-technical PRIs for proactive detection of emerging insider threats.

Monitoring and alerting does not exist for common exfiltration methods [i.e., e-mail, File Transfer Protocol (FTP), transmittal devices, removable media, and cloud storage].

Training and security awareness efforts do not sufficiently address insider threat and opportunities exist to better educate the workforce on their role in reporting suspicious activity. .

Insider threat mitigation tripwires (e.g., excessively large downloads, undue access, altering permission levels) are either infrequently monitored or not adopted into the IT infrastructure.

The organization lacks a risk-based, targeted monitoring strategy for individuals at increased risk for committing an insider act based on their separation status.

The table below captures common vulnerabilities identified through various insider threat engagements. The following areas represent findings for newly established insider threat programs.

Employee Lifecycle Reviews

The organization has not established a clear owner, defined insider threat, developed an insider threat response plan or prioritized insider threat as a critical threat vector.

Increased risk that the organization may fail to stop or disrupt an emerging insider threat due to failure to correlate PRIs.

The organization’s critical assets are exposed to a potential malicious, complacent or ignorant insider threat.

Employees with access can exfiltrate data from the secure environments due to lack of monitoring on exfiltration methods.

Supervisors may not be aware of suspicious behaviors that should be reported and proper mechanisms for reporting.

Tripwires targeted at malicious insiders are largely not adopted into the IT infrastcutre increasing risk exposure.

The organization is vulnerable by not reviewing activity of separating personnel who are more likely to commit an insider act.

Impact

Common Observations

- 9 - Insi

der_

Thre

at_P

rese

ntat

ion.

pptx

Insider Threat – Applying Cyber, Automation, and Analytics

Employee

Normal External Interaction

Normal Activity

Questionable External Interaction

Anomalous Interaction

Common Characteristics

10 Considerations For Building A Program

- 11 - Insi

der_

Thre

at_P

rese

ntat

ion.

pptx

1. Define Your Insider Threats – Don’t be surprised if your organization hasn’t defined what an insider threat is. The reality is few organizations have a specific internal working definition as security and IT budgets have historically prioritized external threats.

2. Define Your Risk Appetite – Define the critical assets (e.g., facilities, source code, IP and R&D, customer information) that must be protected and the organization’s tolerance for loss or damage in those areas.

3. Optimize A Broad Set Of Stakeholders – The program should have one owner but a broad set of invested stakeholders. Establish a cross-disciplinary insider threat working group that can serve as change agents and ensure the proper level of buy-in across departments and stakeholder (e.g., legal, physical security, policy, IT security).

4. Don’t Forget the Fundamentals – The insider threat challenge is not a purely technical one, but rather a people-centric problem that requires a holistic and people centric-solution. Organizations should avoid the common pitfall of focusing solely on a technical solution as the silver bullet.

5. Trust But Verify – Establish routine and random auditing of privileged functions, which is commonly used to identify insider threats across a broad spectrum of threats in a variety of industries.

6. Look For Precursors – Case studies have shown that insider threats are seldom impulsive acts. Rather, insiders move on a continuum of the idea of committing an insider act to the actual act itself.

7. Connect The Dots – By correlating precursors or potential risk indicators captured in virtual and non-virtual arenas, your organization will gain insights into micro and macro trends regarding the high risk behaviors exhibited across the organization.

8. Stay A Step Ahead – Insiders’ methods, tactics and attempts to cover their tracks will constantly evolve, which means that the insider threat program and the precursors that it analyzes should continuously evolve as well.

9. Set Behavioral Expectations – Define the behavioral expectations of your workforce through clear and consistently enforced policies (e.g., social media, removable media, reporting incidents, BYOD, etc.) that define acceptable behavior and communicate consequences for violating policies.

10. One Size Does Not Fit All – Customize training based on the physical and network access levels, privilege rights and job responsibilities.).

Top Ten Considerations

Copyright © 2015 Deloitte & Touche LLP. All rights reserved.

This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation.