>> Employee termination procedures.
We don't necessarily want to terminate employees,
but oftentimes it's a matter,
of course, and we're going to have to do that.
When we do, we want to develop
an enterprise-wide checklist to use what
someone separates from the organization,
and you want there to be some type of
process for tracking all accounts,
assigned to each employee.
At the end of their termination proceeding,
you want to reaffirm with them all
nondisclosure and intellectual property agreements
as part of that termination process.
Again, you're just
re-solidifying everything that they had already signed.
That way you can take
appropriate legal action against them if necessary.
You want to notify all employees
about any employee's departure,
where permissible and appropriate,
it doesn't have to be essentially
a very inappropriate or ugly way of notifying everyone,
but you could essentially,
nicely put so and so has
departed or left the organization that way everyone is
informed and they don't find it
funny when this person shows back up at
the office and there's some confusion as to why
this person is here if they should
>> or shouldn't be there.
>> Next, you want to archive,
block access to all accounts
associated with that departed employee.
Then you want to collect all of
the departing employee's company-owned equipment
before he or she leaves the organization.
That way that's going to limit the amount
of access they have
to your company's network and data after they leave.
Next, you want to establish
a physical-inventory system that
tracks all assets issued to that employee,
that way you know what to get.
You want to ensure that you
get those very sensitive items back.
If you have some type of hand receipt in those items,
you'd know what you're looking for.
Again it's hard to figure out
what wrong is if you don't know what right looks like.
Lastly, conduct an inventory of
all information systems and
audit the accounts on those systems.
Especially if the employee knows
>> that they were going to
>> get fired or has started planning on leaving.
If they were working on this high-valued project.
You want to go in and start auditing those accounts.
Just to look for anomalies
>> and some of those indicators.
>> Backup and recovery.
Obviously, you want store backup media off-site,
ensure media is protected from unauthorized access,
and only be retrieved by small number of individuals.
We talked on this,
obviously, if this is the information,
you're going to depend on in the event of an emergency,
you want to ensure
that it's going to be there when you need it.
Utilize professional off-site storage facility.
Don't send backup media home with employees.
This is critical information.
You'll want to make sure that it's ready for
your use and encrypting the backup media and
manage the encryption keys to
ensure backups and recovery are possible.
Again protect your backup data.
Living on, ensure that configurations of
network infrastructure devices, routers,
switches, and firewalls are part of
your the organization's backup recovery plan as well.
In part of that business continuity planning process,
you want to know what's going to
have to be in operation if you have
>> to start backing up and going
>> to executing that business continuity plan.
Next is, implement a backup and recovery process
that involves at least two people,
a backup administrator,
and a restore administrator.
Both people should be able to perform either role.
But essentially, you have two people
on-site to be able to do that.
That way you can ensure a separation of duties.
Regularly test both backup and recovery processes.
Ensuring that your organization
can reconstitute all critical data
as defined by the business continuity plan
or disaster recovery plan.
Ensure this process does not rely
on any single person to be successful.
It's more than just going through
the motions of this process.
In the last lesson,
we'll talk in-depth about some case studies of
people who did do business continuity planning.
They just didn't do a good job of doing
the business continuity planning and some of
the events that they should have foreseen,
>> they did not.
>> When it came time to execute that plan,
it was done in a manner that was not
good and they were not able to continue operations.
Lastly, sabotage,
behavioral issues should be
>> reported by management to HR.
>> If you see someone continually acting out,
continually being a problem,
some of those indicators should be present and they may
begin to start conducting this subversive activity.
The HR should notify
the insider threat team and then they can start doing
their investigation hopefully before
the fact of someone actually subverting the system.
The insider threat team conducts an inquiry of
past and present online activity and
projects future online activity.
Again, it's looking for those sensors
>> and indicators and trying to come up
>> with a picture of what might occur.
>> Theft of IP.
An employee who has access to sensitive information,
our intellectual property such as trade secret,
source code, engineering or scientific info,
strategic plans, the recipe for
Colonel Sanders chicken quits.
You want to start doing
an investigation of that employee,
what they had access to.
HR should notify the insider threat team
to conduct an inquiry on past
>> and present online activity and to project
>> future online activity with
a particular focus on logs and activity for
30 days before and after the insider resigned.
That's just covering your basis,
making sure that that data
did not leave with that employee.
Moving on, we talk about fraud.
An employee is experiencing
extreme financial difficulty or
has had a sudden unexplained
>> change in financial status.
>> We've talked about the indicator that undo athletes,
management should tell security or HR,
which will then inform the insider threat team of
that potential indicator that
that person may be an insider threat.
The insider threat team would increase monitoring of
financial transaction data and PII
that could be susceptible to financial theft or fraud.
Creating these insider threat programs,
ensure that legal counsel determines
the framework the team will work in.
Obviously, you want to be within the confines of
the law and everything that
insider threat team does should be legal.
You want to establish policies and procedures
for addressing insider threats that include HR,
legal security management, and information assurance.
You also want to consider establishing
a contact with an outside consulting firm,
that is capable of providing
incident response capabilities for
all types of incidence.
If the organization has not yet developed
the expertise to conduct
the legal objective and thorough inquiry.
If you don't know how to do it,
find someone that does.
Formalize an insider threat program
with a senior official of the organization
appointed as the program manager that can
monitor for and respond to the insider threats.
Implement insider threat detection rules
into your detection systems.
Review logs on a continuous basis
and ensure watch lists are updated.
Lastly, ensure the insider threat team meets on
a regular basis and maintains a readiness state.
Establishing a baseline.
We talked about if you don't know
>> what right looks like,
>> it's hard to figure out what wrong looks like.
Use network monitoring tools
to monitor the network for a period of
time to establish baseline
of normal activities and trends.
You want to deny VPN access to foreign countries
where a genuine business need does not exist,
and you want to white list countries where
a genuine business need does exist.
You want to establish
which ports and protocols are needed for
normal network activity and
configure devices to use only those services.
Next, you want to determine
which firewall and IDS alerts are normal.
That way you know what is abnormal.
Either correct what causes
these alerts or document normal
ranges to include them
with network baseline documentation.
You want to establish network activity baselines
for individual subunits of the organization,
and you want to determine
which devices on a network need to
communicate with the others and
implement access control list,
firewall rules, and other
technologies to limit communications that should.
Lastly, understand VPN user requirements.
You want to limit access to certain hours and monitor
bandwidth consumption because that could be a way
someone would easily take data off your network.
Established which resources will be
accessible via VPN and from
what remote IP addresses and you want
to alert on anything that is outside of the door.