>> In order to identify who might be an insider threat,
there are essentially indicators
of activity that you can look for.
As you can see across the top line,
those indicators are broken down into sections.
The first section covers violations,
generally of policy,
if someone habitually violating
physical security policies
and our cybersecurity policies.
Because a lot of this information
is very special and very unique,
it is oftentimes stored in hard to get hard to reach
places where there are
physical and cybersecurity protocols.
I'm told that the secrets of
Kentucky Fried Chicken are essentially
stored in two vaults in Louisville,
Kentucky, and no one has access to
any one of the two vaults, but that's just rumors.
But anyway, if someone was going
to try and steal those secrets,
they would need to get some type
of physical access to that information.
Generally, there would be some type of violation of
policy that would go in
conjunction with them trying to steal that information.
That would either be a physical security violation
or a cybersecurity violation.
If someone starts to get a lot of these violations,
it could be indicative that they
are some type of insider threat.
The next group is going to be failing to
report certain information that
an organization might find useful.
For instance, if you work for the government
and you have a security clearance,
you're generally required to report certain financial,
travel, and contact information.
Finances, if you are heavily indebted,
if you're going through a bankruptcy,
you're required to report that on what is called your SF
86 that details
essentially your life history to the government.
That way, there's nothing that's
hidden or that you're trying to hide from the government.
Essentially, they know that you're deeply in
debt and you've got a plan,
and you're working to try and fix that because
obviously money is that motivating factor.
The next one is going to be travel
outside of the country.
Not to say that going to certain locations for
a planned family vacation should be considered strange,
but if all of a sudden someone just up and leaves,
and goes to this foreign country
that they've never talked about,
never had any interest in,
that would be probably indicative of
some suspicious behavior and more than
likely some type of insider threat activity,
which may reflect that they're going
to another country to meet some type of
contact who's willing to push them in
that direction of being that insider threat.
Lastly, we'll follow that up with contact.
Does this person have a lot of
foreign contacts that they would have no reason to have?
Oftentimes, you're required to report that again
on your SF 86 just due to
those foreign relationships and
someone from a foreign government or
a company trying to
pressure you into some type of relationship,
which we talked about earlier.
The next one is going to be physical access rosters.
Card blobs, door logs, signin-signout rosters.
Generally, if you have somebody who
works in 8:00-5:00 and all of a sudden
you start seeing them
show up at 8 o'clock at night repetitively,
that could be something is going on.
Same thing with the signin-signout rosters.
However, that goes a step further.
Maybe someone signs in and they don't sign out,
and they do that habitually to try and hide their tracks.
Those could be indicators that
that person could be an insider threat.
The next category is going to be cyber actions.
We'll cover that in
depth after we get through the rest of these.
We'll come back to that.
Moving on, we'll go to foreign travel.
Again, like we talked about,
the unexplained new and out of character crap.
That's not, I have
this really great interest in going to Australia,
I talked about it all the time, and finally,
I've saved up enough money to go to
Australia. It's really cool.
I've taken pictures of it.
What this talks about is that someone all of a
sudden they're acting quirky.
Then next week, they take a bunch of leave and
their off to this country that you've never heard of.
It's out of character for their pattern of life.
The next category is going to be finances..
This could be undue affluence.
You know that your buddy Joe makes
$50,000 a year and you make $50,000 a year,
and you know how hard it is.
You guys oftentimes talk about that
and you drive this old car,
and he drives an old car.
All of a sudden, Joe comes in
and he's got this brand new Jaguar.
That's showing that undo affluence.
Especially if he hasn't inherited
a lot of money or won the lottery,
it's very odd that all of a sudden he is now
able to afford this brand new Jaguar.
If you decide to go to Joe's house
one day and all of a sudden he has
completely redecorated the house with these two
or $3,000 draperies,
that could be indicative that he has come
under some undue affluence.
Conversely, if someone has massive amounts of debt,
they have more debt than they would ever be able to pay
off in their lifetime and for
their their level of income,
that could be an indicator that they
are a potential insider threat.
Or if they have a potential gambling habit
and it's out of control,
they could be an insider threat.
Especially if they have access to
this very special and unique information,
they would be more likely to want to sell
that information to you to cover
their gambling debts or to cover their massive debt.
The next category is material transfer.
This talks about either downloading large amounts of
material or gathering up
the material and throwing it in a garbage bag,
and walking out of the FBI building
like Robert Hansen did.
Any type of removal of sensitive material,
would be an indicator that
that person could be an insider threat.
The next one are social indicators,
so things that they're saying
internally and things that they're saying externally.
If you have this employee who comes to
work and he's been very chatty,
has a good history,
and all of a sudden you see
a marked shift in his behavior,
he's no longer chatty.
>> He is hostile towards his co-workers.
That could be an indicator that,
one, there's something going on with that employee.
That, two, that he might be an insider threat.
Then, externally,
what are his social relationships like?
Is there a marked change in how
he interacts outside of work,
especially if you have co-workers who hang
out together outside of work on social setting?
Moving on, communication.
If you're looking at how
an employee uses their social media,
a lot of times you have companies that
monitor employees and their social media presence.
All of a sudden, you see this employee
start bashing your organization
saying how much they hate working there,
it's like going to work in salt mines.
That could be an indicator that that person
has the potential to be an insider threat.
Likewise, the misplaced loyalty.
Generally, that applies to a government where
someone is starting to say that they
dislike the United States of America,
that they prefer this other country,
that would be an example of misplaced loyalty.
Going back to cyber actions,
there are, again,
subcategories on cyber actions.
Again, we have reconnaissance.
That would include doing
web browsing, database searches,
or net scanning of
your organization's network to
try and figure out
vulnerabilities just like a hacker would.
That would be indicative of someone
who's becoming an insider threat.
Entrenchment is going to be
that next stage which should be,
again, familiar with that anatomy of a hack.
Someone who might be installing
sensors to figure out what is going
on within that network or
unauthorized software on their computer,
or they're making themselves entrenched in that activity.
The next one is where they actually go in and
start exploiting the network.
They're going to escalate their privileges,
so that they have just certain read processes.
They may want to escalate that to read,
write, or if they only have a secret clearance.
They may want to escalate
their privileges up to a top-secret clearance.
Then we'll go to password cracking,
trying to get passwords either through
technical means and/or by social engineering,
per se, going around to individuals and work
and using their leverages.
A computer administrator saying,
I need your password so I
can log into your account and do
something and then actually masquerading as that person.
Then account misuse.
Doing things with their account
that they're not supposed to do.
Moving on from there,
we'll go to the extraction of data.
That could include printing large amounts of data,
again, filling the garbage bag and walking out with it,
downloading massive amounts of data to some place,
or uploading it to maybe Google Share folder or
a Office 365 folder that they
shouldn't take that data to.
Removable media. If your organization doesn't
have a digital laws prevention policy in place,
you have someone who brings in the sport terabyte
hard drive and they're downloading the state secrets,
that would be a good indicator
that they're an insider threat.
Or someone who goes to the copy machine
a lot and is making
duplicate copies of data that they come across,
that again would be indicative of the insider threat.
Moving on from there is, how
does this person communicate?
Are they using encrypted mail at
work such as the old Hushmail or the new
ProtonMail trying to email their contact information?
Are they receiving coded messages?
Are they using covert channels to try and
hide some of the activity that they're doing?
The next category is manipulation;
changing file permissions up or down.
All of a sudden, I've got access
to this document and someone
changes it so I can't access it and see what's going on,
that would be an example.
Or deleting files.
As we've talked about earlier,
someone who is hacked off at the organization,
they may want to delete all of the files that
are within this folder,
or that contain, again,
the secret to Colonel Sanders' chicken,
and that someone deletes that and it's gone,
how do you recover from that?
Or changing the file data.
You've got that, again,
Colonel Sanders chicken recipe and you
add too much paprika,
essentially changes the consistency
of the recipe and it may ruin your business.
Moving on from there,
you have the counterintelligence concerns.
If someone is searching the human resources or
security databases about themselves,
trying to figure out what information the company may
be gathering about that person
to see if someone may be on their tracks.
Disk erasure and destroying an evidence.
They're going to try and cover up
any activity or any evidence
of the activity that they've done.
Those would be indicative of an insider threat.
Then lastly, someone who was looking
at pornography or gambling at work.
Again, those are just blatant violations generally of
a company policy and
that could be indicative of other problems,
and it might actually lead to
someone being an insider threat.
Again, not everyone who exhibits
some of these indicators
is going to be an insider threat.
One who starts seeing
large amounts of these indicators checked off,
that is going to be generally a good assumption that you
might want to look at that person a little bit more.
Out of all that consolidate that down into
some sensors that you can look at for individuals.
Honeypot, Honeynet data.
What are they doing on your network?
Call patterns and call logs.
Are they making calls that are
inconsistent with their daily activities?
Or all of a sudden,
are they picking up their phone,
or are they calling the Russian embassy trying
to get information out of your organization?
Email patterns. Are they emailing
individuals outside of your organization or are
they emailing someone in another country that
your business doesn't necessarily
have business dealings with?
That would be indicative.
Again, travel and vacation.
We've talked about these strange trips
to these foreign countries
that they've never had any desire
or talking about going to before.
Maintenance schedule. That would be a good sensor
of looking at someone to see if they
might be an insider threat
so you can schedule maintenance and then
go in and look at certain information of that person.
Keyboard logs. If your organization
starts logging information via the keyboard,
you can look to see what that person
is doing at their workstation.
File system logs.
To see if they've changed permissions of files,
what files they've created,
what files they've looked at.
Is that in conjunction with
their roles and responsibilities?
Are they looking at new information
that they've never had access to before?
That would be a sensor to see if they're
an insider threat. Trouble tickets.
Again, if someone is having
massive amounts of computer problems because they're
dorking around with the system and trying to exfiltrate
data or do something to
their computer to enable them to be that insider threat,
they might have trouble and are having trouble tickets,
and that could be indicative of
that person being an insider threat.
Then again, your IDS logs;
what information is coming in and out of your network?
Then lastly, system logs;
what are they doing on that system?
Is there a bunch of security alerts
that you may need to review?
Again, those are just some ways that you could look to
see if you can find some of those indicators.