>> Hello Cybarians, and welcome back
to incident response and advanced forensics.
My name is Max Alexander and I'll be
your subject matter expert for today's course,
which is insider threats,
that happens to be one of my favorite topics.
First and foremost, we need to set the definition of
what exactly is an insider threat.
We'll break this into two parts.
An insider is anyone with access,
privilege, or knowledge of
information systems and services.
Essentially, they're going to have placement and
access to your information.
Examples of insiders could be employees, contractors,
trusted business partners, or individuals who may
be involved in a merger or acquisition process.
What separates that normal insider from
that malicious insider or insider threat?
Malicious insiders are motivated to
intentionally adversely
impact the organization's mission.
They're going to seek to deny, damage, degrade,
or destroy some type of information that you have,
or seek to release that information to the public and
thereby degrade or damage your organization as a whole.
Examples of malicious insiders that have come from
the news would include Pvt Manning, Edward Snowden,
Dejan Karabasevic, Wen Ho Lee,
I'm pronouncing these Chinese names,
Guoging Cao, and Shuyu Li.
Those are just some examples
of individuals who have committed
insider threat and have exposed information or have
stolen information from their employers.
What is the danger of an insider threat?
Insiders have placement and
access that outsiders don't have.
That means they're already inside your organization.
For some part, they've already been vetted,
and they've been given access by
you and you have some level of trust in them.
The second bullet point is that they
are already inside and they may
possess knowledge of trade secrets
or highly sensitive information
on a routine basis that
you obviously or hopefully would not have hired them.
Worse, they are trusted and rarely
watched as closely as an outsider would be watched.
Then due to the level of trust placed in insiders,
they can manipulate that trust to
cause harm to the organization.
They'll use that trust,
they'll use that placement and access to
essentially perpetrate for their crimes.
Bottom line, an organization
does not knowingly hire a traitor.
Rather on rare occasions,
an organization hires someone it
believes it can trust who either
successfully hides his or her intention
to commit espionage,
or more commonly, later finds
themselves in circumstances that
for any number of personal complex reasons,
>> presents espionage,
>> or in an industrial case,
theft of intellectual property
as a reasonable even attractive choice.
In order to go through this process of
becoming an insider threat,
someone has to have means, motive,
opportunity, and the belief that
they're generally going to get away with their crimes.
That goes back to that criminal justice element
>> of trying to find and figure out who's
>> going to be an insider threat.
The dangers again, to summarize and capstone that,
insiders can steal your intellectual property.
For instance, if your business has
this one really cool widget that makes
it what it is and someone from inside
your organization gives away that widget,
or if you work for Kentucky Fried Chicken and
you give away the Colonel's secret,
essentially you're damaging that business.
Fraud, so if you work in a financial services sector
and that person has placement access to financial data,
they can essentially start stealing some of that data.
The most recent case is
the Wells Fargo fiasco
that happened here at early October 2016,
where there's essentially fraudulent accounts
created for customers at Wells Fargo.
Then lastly, sabotage,
and that could include compromising
the availability or the integrity of data.
If you've got someone that works in
your organization and they're hacked off,
they've been fired, essentially,
they could go in and start deleting files or records,
making them unavailable, or they could start changing
information on those files and
records altering their integrity.
Those are the dangers that those insider threats pose.
To look at the motivations of
what drives an insider threat to do what they do,
there has been some studies by
psychologists and the Central Intelligence Agency
>> looking at the motivational factors.
>> A lot of folks have tried to pigeonhole these and
narrow these down into some very broad categories.
It doesn't mean these are
the only categories that exist,
but these are some pretty common ones.
The acronym for this is MINCEs.
The first is money.
Individuals who are in
a generally tight financial position
or who are just greedy,
they may be motivated by money to
be a spy or to steal your intellectual property.
Moving down from there is ideology.
Someone who holds strong convictions
that drive them to do something, for instance,
if they believe so strongly that they do not like
the capitalist system and they want to take
down your major big bank,
that ideology will be driving them to
commit insider threat activity.
Nationalism, which we see a lot of in the government,
where individuals who are generally
approached by China or
some other large country who
wants to compete economically with the United States,
essentially, they'll get thrown the card that, hey,
you guys are ethnically Chinese,
we're Chinese, don't you want to see China be great?
They'll be pitched that way and
essentially that will be
their motivation for committing espionage.
Not to say that
every Chinese person is
a danger or threat to be an insider threat,
but that just is one example.
The next one is going to be compromise,
also known as blackmail.
If you've done something that you
don't want someone to know about,
and they figure out that you've done that thing,
essentially, they could blackmail you
into going into work and becoming that insider threat.
The next one is going to be ego.
The insider threat thinks they're
smarter than everyone else is,
and they're going to do this for ego.
A good example of that
was Robert Hansen who work for the FBI
and betrayed the government by
giving up secrets to Russia.
It could just also be that they're looked down
upon at work and to prove
themselves that they're better
than the people that they work with,
they will commit those insider threat activities.
Then the last one is sex.
That's your classic honey net
where someone is lured into a sexual relationship,
and then that person turns out to be
pushing that individual towards
being that insider threat.
Those are some of the basic motivations and
categories that psychologists have
come up with over the years.
Another acronym is RASCLS.
This generally applies to
foreign controlled insider threats specifically.
Reciprocation is going to be
the first type of motivation.
Tit for tat, I do a favor for you,
you do a favor for me.
Generally, this starts out on a small scale where
someone is put in a position where
they have something done for them,
and then that other individual will say,
I've done a favor for you,
you now owe me
a favor and then it just builds and builds,
and then eventually it turns into
an insider threat or an espionage type of activity.
The next one is going to be authority.
When you're in some of these relationships,
a lot of times, there's going to be
>> a more dominant type of personality.
>> As the relationship develops,
usually the person who's driving
that other person to commit espionage and or
insider threat activities will try and be more superior
and direct the actions of
that other person through a position of authority.
The next one is scarcity.
That speaks to itself.
If you're in a relationship with another person
>> and your resource poor due to
>> Maslow's hierarchy of needs, a lot of times,
whoever you're dealing with may be
able to provide you money, food,
whatever it is that you're in need of,
and due to scarcity,
that will drive that person to be
an insider threat and or a spy.
Moving on is commitment and consistency.
This usually is for preexisting
relationships where someone is already
an insider threat or a spy,
and there's going to be some type of turnover in
that relationship where they're going to
be dealing with a new handler
or someone who's going to be
pushing them to be that insider threat.
Due to the past relationship,
they're going to get that person
to again renew their commitment and
being consistent with providing that information.
The next one is just good, old-fashioned liking.
We get into a relationship, you like me,
you want to do favors for
me just because I'm a nice guy,
and it turns out I'm trying to drive you to commit
espionage and or insider threat activities.
The last one is going to be social proof.
Again, that goes on that ego,
I have to provide myself that I'm better,
I've got some type of depressed sense of self worth,
and in order to essentially
elevate my sense of self worth,
I have to be this insider threat or spy.
Again, just another way of
looking at some of the activities
that drive an individual to become an insider threat.