>> Moving on to policy enforcement.
You want to ensure that senior management advocates
>> and forces and compliance
>> with all organizational policies,
>> and then policies
>> that do not have management buy-in will fail
>> and will not be enforced equally.
>> We've all been in these organizations where someone
provides a lot of lip service that
this policy is important, however,
when it comes to them actually abiding by that policy,
it doesn't occur.
>> Bottom line is that management
>> must comply with the policies.
>> If they don't do it,
someone sees them not doing so,
then no one in an organization's
>> going to follow those policies.
>> Moving on, ensure management briefs
all employees on policies and procedures.
Employees, contractors
>> and trusted business partners should sign
>> acceptable use policies upon their hiring
>> and once every year thereafter
>> once significant change occurs.
>> Again, this is just providing that foundation
>> for firing someone and/or going back
>> and taking legal action against them.
It also establishes the policies
>> so you do have some type of indicator to look for.
>> Moving on, ensure that management makes policies
>> for all departments within your organization
>> easily accessible to all employees.
Posting policies on
>> your organization's internal website
>> can facilitate widespread dissemination of documents
>> and ensure that everyone has the latest copy.
>> I would actually, in conjunction with that,
make them sign that they have read it.
That way again, when it comes time
>> for termination proceedings
>> or it comes time for legal action,
>> they have a signed document
>> that says that they have read those policies.
>> Policy enforcement continued ensure that management
makes annual refresher training for all mandatory.
Again, this is just providing
additional reinforcement of those policies and again,
having someone sign that they have taken this training.
Next is ensuring that management enforces policies
consistently to prevent the appearance
of favoritism or injustice.
Again, that goes back to
equal enforcement of policies
and adhering to the policies by everyone.
If someone gets the impression
that the policies only apply to certain people,
the policy again will not be followed.
Awareness and reporting; this is where we get
into identifying some of those indicators.
Oftentimes it may not be the IT staff
>> who find these indicators,
>> it may be their employees,
are their co-workers that
help identify some of these indicators.
The first part of this is to develop and implement
an enterprise wide training program that
discusses various topics related to insider threat.
Just like what we did today,
I've given you information on some of the indicators of
>> what an insider threat might look like.
>> Then next you would want to train
all employees and contractors on security awareness,
including insider threat before giving
them access to any computer system.
Make sure to include training for employees
>> who may not need to access computer systems daily
>> such as janitorial and maintenance staff.
Because those users may require
special training program that covers security scenarios
they may encounter such as social engineering
>> and sensitive documents left out in the open.
>> Going back to this old military
guidance's that every soldier is a sensor
and essentially every person is responsible
>> for being a look out
>> in a security element within the organization.
You want to have this training conducted consistently,
but keep in mind the training
>> doesn't have to be classroom oriented.
>> It could be posters, newsletters,
alerts, brown bag lunches,
something that continually flashes
across the monitors in your work environment,
anything of that such to help reinforce those policies.
Then lastly, you want to establish
an anonymous confidential mechanism
for reporting the security incidents.
Ideally what you want to do,
is that you want to encourage people to report things,
even if they are nonsense.
That way, you'd get
the information to you because oftentimes,
one of these cases may not be nonsense
and you don't want to discourage people from reporting,
but you also want to it be confidential
>> to protect that person
>> who's come forward
>> and start to volunteer that information.
>> If you cannot protect
that source of information
>> then they will no longer provide you
>> what you're looking for.
>> The next topic's going to be hiring practices,
and we kind of touched on this earlier.
You want to ensure that
potential employees have undergone
a thorough background investigation
>> which at a minimum should've include a criminal
>> background and credit check.
Whatever standard that you decide to follow
>> basic criminal background check is important.
>> You want to ensure employees to report
suspicious behavior to appropriate
personnel for further investigation,
and you want to investigate,
and document all issues of
suspicious or disruptive behavior from your employees.
Next, you want to enforce policies
and procedures consistently for all employees.
So kind of rehashing the same idea
>> and then consider offering
>> an employee assistance program.
>> These programs can help employees deal with
many personal issues and confidentiality.
If someone may be having a life crisis,
getting them help could help
prevent them from going down that road
>> and being that insider threat.
>> Next, you want to remove
any negative influence with
it's within your organization.
You want to enhance monitoring of employees
>> with an impending or ongoing personal issue
>> in accordance with organizational policy and laws.
>> Those individuals who you know
>> have had individual problems,
>> they could start to turn out to be that insider threats
so additional monitoring of
their activities would be warranted.
You want to enable additional auditing
>> and monitoring controls outlined
>> in your organization's policies and procedures,
>> and regularly review an audit logs to detect activities
>> outside of the employees normal scope of work.
>> Then you want to limit access to these log files
>> to individuals that have need to know.
>> Then lastly, all levels of management must regularly
communicate organizational changes to all employees.
This allows for a more transparent organization
and employees can better plan for their future.
That last one is going to
help prevent that negative influence from starting.
A lot of time organization that may surprise
employees with these drastic changes
and that could cause that negative
influence in their life which may start them
>> down the road to being that insider threat.
>> Know Thy Self.
>> If you don't know what wrong looks like
>> or you don't know what right looks like,
>> it's hard to separate one from the other.
The first step in that process is
>> to conduct a physical asset inventory.
>> You want to identify asset owners
>> and the assets functions,
>> and you also want to identify
>> the type of data on that system
>> that way you know exactly what you have.
>> If you don't know what you have,
it's hard to know if it's missing.
Understand what data your organization processes
>> by speaking with the data owners
>> and users from across your organization.
>> Especially if you're in a big organization,
it's hard to know exactly what goes on all the time.
But if disaster does happen,
you need to know how to rack
>> and stack your triage of these systems.
>> Then you want to identify and document
software configurations of all assets.
It's hard to know if something
changes if you don't know where it started.
Then lastly, prioritize assets
>> and data to determine the high-value targets.
>> Obviously you would want to secure those targets first,
and/or start your investigation
>> on those targets should an incident occur.