>> A lot of the stuff that we talked about, it's great,
but you may not have time to look at
20,000 people in your organization looking,
checking all of these sensors
for all of those indicators.
But you're in luck.
There are tons of
automated programs out there now that can help
you start looking and automating these processes.
I've listed just a few of the common ones.
There are obviously others out there.
The first one that I've listed as Net Spy Pro.
It's monitoring software
>> works across multiple computers,
>> but does not permit
external devices from connecting to the computers,
but you can again buy that DLP technology separately.
But that is one type of technology to use.
Veriato or formerly known as SpectorSoft,
it includes Investigator, Recon and 360.
That's going to be a behavior analytics
and activity monitoring type of software.
It's going to start aggregating a lot of that data and
looking for those anomalies within that behavior.
The next one is going to be ObserveIT,
and it's a complete visibility and
all employee activity stack rank
where you look at your riskiest users.
Then you can begin to
enforce company policies with certain notifications.
Securonix is another one.
Then lastly, you have Splunk.
A lot of people are familiar with it.
Splunk, you can correlate
multiple data sources to identify
high-risk behaviors by employees and contractors.
Again, those are just some automation tools
that are going to go in and start
looking at a lot of
those indicators and sensors that we talked about.
Again, if you don't have a large organization,
you can do all of this by hand.
Just note that it will take time.
Then some of these things that you would
be able to go in and look after the fact,
if have found out that someone is an insider threat,
you can go back and start looking for
those indicators and the evidence that you have.
That would be how you would do that investigation.
But like we said,
we want to essentially prevent
the insider threat activity before it happens.
Going back and looking at
the material after it's happened,
it's already there, it's evidence.
You can go back and you can check those sensors.
You can check for that indicative behavior,
of, was this person an insider threat?
You can check their computer logs,
and you can figure out who they were talking to.
That's all well and good,
but your data's still gone.
Preventing that is what we hope to
accomplish through this course.
First and foremost, you want to have
all your employees, contractors,
and trusted business partner sign NDAs upon
hiring and termination of employment contracts.
Again, that's just a piece of paper.
It will not guarantee that someone does that.
However, it does provide some type of
legal recourse if you do
find out someone has absconded with your data.
The next one is to ensure
trusted business partner has performed
background investigations on all of its employees
that will have access to
your organization system or information.
They should be commensurate with
your organization's own background investigations and
required as a contractual obligation.
Obviously, you're doing
background checks on your employees,
so a certain standard.
You would not want someone else
to bring in their employees into
your own organization with
a lower standard of background checks.
You would want to be equal,
especially if you're dealing with
>> the same type of data.
>> Moving on, for acquiring companies
during the merger or acquisition,
perform background checks,
investigations on all employees to be
acquired at a level commensurate with its own policies.
Again, when you're acquiring these companies,
you're going to bring in folks to your organization.
You want to know who you're bringing on and you
want everyone to be cleared at the same level.
Next, you'll want to prevent
sensitive documents from being
printed if they are not required for business purposes.
Insiders could take a printout of their own or
someone else's sensitive document from
a predator garbage desk for
office electronic documents can be easier to track.
You can also definitely watermark those documents.
But again, if you are dealing
with massive amounts of sensitive information,
leaving things on the printer or the garbage dumpster,
memory holds, someone could go by and
pick up that information and walk out the door with it.
Ideally, you want to have
certain policies in place to limit
the amount of printing and the amount of
paperwork that is thrown in the garbage.
Next, you want to avoid direct connections with
information system of
trusted business partners, if possible.
Provide partners with task-related data without
providing access
>> to your organization's internal network.
>> Again, that goes to that principle of least privilege.
If they don't need access to certain information,
don't provide it to them.
Give them the least amount of information possible.
The next, restrict access to
the system backup process to
only administrator responsible
for backup and restoration.
That makes sense because if you
don't limit that access and anybody can
get a copy of
that backup process or access to that backup process,
when or if an incident does
occur and you're trying to do your backup,
and you find out your backup is destroyed or corrupted,
it doesn't do you a lot of good.
Protecting access to that backup is very important.
[NOISE] More prevention tips continued,
prohibit personal items in
secured areas because they may be
used to conceal company property
or to copy and store company data.
If your organization doesn't have any security
policies and people can just
bring in whatever they want,
you may want to take a look at that.
Because people could be
walking out the door with the data,
and there's no way you would ever know.
In the government world, especially
with information security
and the level of classifying information,
in a lot of instances,
you're not able to bring in
certain items to your work location.
Next, conduct a risk assessment of
all systems to identify critical data,
business processes, and mission critical systems.
Then for more information,
you can see the NIST Publication 800-30.
But be sure to include insiders and
trusted business partners as part of the assessment.
Essentially, looking at
everything to identify weaknesses and then trying
to remediate those weaknesses will
help you stay off disaster, hopefully.
The next one is to implement
data encryption solutions that encrypt data seamlessly,
and that restrict encryption tools
to authorize users as well as
restrict decryption on the organizations
encrypted data to authorized users.
Basically, you want to secure your data in some type of
manner that allows only people to
access that data who you want to access it.
Next is implement a clear separation of duties between
regular administrators and those
responsible for backup and restoration.
It doesn't allow someone to
have too much power and too much authority.
The next, forbid regular administrators
access to system backup media
or the electronic backup process,
which we talked about earlier.
If one of those people is compromised,
they already have very high levels
of rights to begin with,
they could damage your system on
one side that they had access to that backups,
and they can damage it on the other,
and that would be a complete ruining
of your information systems.