>> Social media policy, you want to establish
a social media policy that defines
acceptable uses of social media,
and information that should not be discussed online.
One of the activities
or methods that the government was able to start
looking for individuals is
that people post a lot
of data that they shouldn't online.
I think there was a case where Vice News did
a study of some of
the Russian soldiers who were in Crimea.
Then based on this person's post,
they were able to determine that this soldier,
who was a Russian was in Crimea and Vice News
tracked this guy back to his home in Siberia.
This all the time was during which Russia
was saying that they weren't not in Crimea at all.
Knowing how to use social media,
could be very important to your organization.
Hopefully you're not invading Crimea.
But again, that's just a very extreme example.
Improved social media awareness training is part of
the organization's security awareness training program.
You want to encourage users to report
suspicious emails or phone calls
to the information security team,
who can track those emails to identify
any patterns in issue alerts to users.
Then lastly, consider monitoring the use
of social media across the organization,
limited to looking in a manner approved by
legal counsel for postings by employees,
contractors, and business partners.
Closing the door to data exfiltration.
You want to establish a Cloud computing policy.
You should be aware of what Cloud services are
operating and how employees can
use them to exfiltrate data,
and you want to restrict or monitor
what employees put into the Cloud.
Establishing some type of Cloud
access security broker policy
to do that is going to be in your benefit.
You want to monitor the use
of printers, copiers, scanners,
fax machines because those are places where
individuals could abscond with data.
You want to create a data transfer policy
and procedure to allow sensitive
company information to be
removed from the system only in a controlled way.
When it's removed, you want to know it's removed.
You want to establish
a removable media policy and
implement technologies to enforce it.
Some type of DLP technology on your laptops to
prevent devices from being plugged in.
Restrict data transfer protocols such as FTP, SFTP,
or SCP to employees with
justifiable business name and you want to
monitor that use so you
know what's going over the FTP servers.
Lastly, inventory all connections
to the organization's enclave.
Ensure that SLAs and your MOAs are in place.
You want to verify the connections are
still in use and have a justified business need.
Obviously, you want to know what's
connected to your network, why it's connected.
If it's something that you don't need,
I would highly recommend disconnecting.
Lastly, we will talk about
the case study of Robert Hanssen.
He was an insider that was in the FBI.
He was very trusted.
Essentially, the FBI hired
Robert Hanssen in charge of trying to find himself.
He wasted a lot of time of the FBI trying to do so.
During the time of his alleged illegal activities,
Hanssen was assigned to New York and Washington
DC where he held key counterintelligence positions.
Those were the individuals who essentially
looked for spies. But he was one.
As a result for his assignments,
Hanssen had direct and legitimate access to
voluminous information about
sensitive programs and operations.
Because he had access to all of that information,
he was trusted and
he should not have been trusted and he had
numerous indicators about him
that people should have paid attention to.
He did have massive amounts of
money in his home
when it was searched and he was arrested.
He had numerous security violations.
He had actually filled up garbage bags,
full of classified information,
and walked down of the FBI building with that.
As part of that information,
he gave up at least 10 FBI, CIA double agents.
Possibly he gave up General Polyakov a call,
and at least three of the individuals
he gave up were executed.
The General Polyakov source,
he was a pretty valued source
for our government intelligence element.
He provided many documents such
as the Continuity of Government planning,
the National HUMINT Collection Plans,
over 6,000 pages of documents,
and the details that the FBI had
tunneled underneath of the Soviet Embassy.
He spied for more than eight years and
the extent of damage that he caused may never be known.
Currently, he is serving a life in
prison in a supermax prison in Colorado.
He will not be executed
because individuals still have to go and
interview him and talk to him about
the extent of the damage that he
caused the United States government.
This is again, a very extreme example
of an insider threat,
but serves as what can happen
when these individuals
>> and these indicators go unchecked.
>> I know that was a lot of information.
But again, this is a very important topic and something
that a lot of organizations may
not have been focusing on.
If you're going to do anything in your organization,
it's very important to understand one,
what data you have and what makes
your organization special and then how to protect them.
Not just protect it from people on the outside,
but protect it from people on the inside as
well because oftentimes those are
going to be more dangerous attacks
than any external entity can be
because these individuals that are around
you have gone through some type of vetting process.
When someone starts to go off the rails or
starts to become that insider threat,
there are different types
of indicators that we talked about,
sensors that you can look for and through
to try and help whittle
down who might be an insider threat.
Now again, not everyone who exhibits some of
those indicators is going to be an insider threat.
But when you start seeing multiple indicators,
that would essentially be someone
who would warrant further suspicion.
Again, we talked about
the automated process of
working through those and how some of
these technologies can establish
a rank order of who might
be an insider threat based on
all of the data elements that it's going to pull from.
Then lastly, we talked in-depth on
creating the policies of how to
enforce insider threat policies and what to look for,
how to train your employees,
and then how to help secure
your organization and make it more resilient,
or resistant to those insider threats.
This will conclude our talk
>> today about insider threats.
>> I hope you've enjoyed this.
If you have any questions,
please feel free to email
in any questions that you might have.
I know this was a long in-depth talk,
but if there's something that I didn't cover,
or there's something that you
want more information about,
please feel free to let us know.
Again, I hope you enjoyed the video.
Thanks for watching and again,
come back to Cybrary for more exciting classes.