1 1 00:00:00,510 --> 00:00:01,890 Insider Threat. 2 2 00:00:01,890 --> 00:00:03,500 In this lesson, we're going to discuss 3 3 00:00:03,500 --> 00:00:05,610 the risk of an insider threat. 4 4 00:00:05,610 --> 00:00:07,340 Now, an insider threat is an employee 5 5 00:00:07,340 --> 00:00:10,300 or other trusted insider, such as a contractor, supplier 6 6 00:00:10,300 --> 00:00:13,520 or business partner who uses their authorized network access 7 7 00:00:13,520 --> 00:00:16,650 in unauthorized ways to cause harm to your company. 8 8 00:00:16,650 --> 00:00:18,950 For example, if Tom in sales decides he's going to 9 9 00:00:18,950 --> 00:00:20,190 download an entire copy of 10 10 00:00:20,190 --> 00:00:22,110 our customer relationship management database, 11 11 00:00:22,110 --> 00:00:23,780 and he takes it home with him to sell it 12 12 00:00:23,780 --> 00:00:27,170 to one of our competitors, then Tom is an insider threat. 13 13 00:00:27,170 --> 00:00:29,770 Now insider threats are one of the most dangerous threats 14 14 00:00:29,770 --> 00:00:31,080 to your organization 15 15 00:00:31,080 --> 00:00:33,500 because they are very difficult to find and stop 16 16 00:00:33,500 --> 00:00:35,440 from a technical network perspective. 17 17 00:00:35,440 --> 00:00:38,030 After all, these are people who have authorized credentials 18 18 00:00:38,030 --> 00:00:40,540 to log onto the network and use all the different servers 19 19 00:00:40,540 --> 00:00:42,230 and applications that you provide. 20 20 00:00:42,230 --> 00:00:43,930 They have a valid username and password 21 21 00:00:43,930 --> 00:00:45,100 so they can do their job. 22 22 00:00:45,100 --> 00:00:47,460 But if they're not trustworthy, they can also use 23 23 00:00:47,460 --> 00:00:50,750 that same access to harm your company and harm your network. 24 24 00:00:50,750 --> 00:00:54,010 So what is the best way to catch an insider threat? 25 25 00:00:54,010 --> 00:00:56,570 Well, it's by conducting observation of employees 26 26 00:00:56,570 --> 00:00:57,690 while they're logged in 27 27 00:00:57,690 --> 00:01:00,510 and enforcing a culture of questioning fellow employees. 28 28 00:01:00,510 --> 00:01:02,580 After all, if another employee sees somebody 29 29 00:01:02,580 --> 00:01:03,540 doing some weird things 30 30 00:01:03,540 --> 00:01:06,120 like downloading large quantities of data at weird times 31 31 00:01:06,120 --> 00:01:07,940 of the day, you want them to ask, 32 32 00:01:07,940 --> 00:01:10,060 hey, what are you doing and why, 33 33 00:01:10,060 --> 00:01:12,370 so you can determine if there's a legitimate business need, 34 34 00:01:12,370 --> 00:01:14,810 or is this an insider threat at work. 35 35 00:01:14,810 --> 00:01:17,120 Now I've worked at organizations where we've had employees 36 36 00:01:17,120 --> 00:01:20,150 who were very vocal about their dislike of the organization 37 37 00:01:20,150 --> 00:01:22,260 and how they wanted to see the organization fail 38 38 00:01:22,260 --> 00:01:23,260 or get hurt. 39 39 00:01:23,260 --> 00:01:24,780 Now, once I found out about this, 40 40 00:01:24,780 --> 00:01:27,700 we carefully had to invite them to leave the organization 41 41 00:01:27,700 --> 00:01:29,830 because their services were no longer required 42 42 00:01:29,830 --> 00:01:31,710 and we couldn't trust them on our network. 43 43 00:01:31,710 --> 00:01:33,490 Because if they're that angry with the company, 44 44 00:01:33,490 --> 00:01:35,030 we don't want them hurting our company 45 45 00:01:35,030 --> 00:01:36,730 by stealing our information. 46 46 00:01:36,730 --> 00:01:38,670 Now, a great example of an insider threat 47 47 00:01:38,670 --> 00:01:40,770 comes from the original "Jurassic Park" movie. 48 48 00:01:40,770 --> 00:01:42,850 In that movie, they use a logic bomb 49 49 00:01:42,850 --> 00:01:44,500 to cause harm to the park. 50 50 00:01:44,500 --> 00:01:46,860 Now, a logic bomb is a specific type of malware 51 51 00:01:46,860 --> 00:01:50,180 that's tied to either a logical event or a specific time. 52 52 00:01:50,180 --> 00:01:53,060 In this case, we had a disgruntled IT administrator 53 53 00:01:53,060 --> 00:01:54,580 and they would be an insider threat. 54 54 00:01:54,580 --> 00:01:56,030 And they decided that they're going to make sure 55 55 00:01:56,030 --> 00:01:57,380 that when they leave the company, 56 56 00:01:57,380 --> 00:01:59,400 the company is going to regret it. 57 57 00:01:59,400 --> 00:02:02,340 So going back to this example of the "Jurassic Park" movie, 58 58 00:02:02,340 --> 00:02:04,600 there was an IT administrator who worked for the park 59 59 00:02:04,600 --> 00:02:06,120 that housed all the dinosaurs. 60 60 00:02:06,120 --> 00:02:08,380 He decided to create a script that would continually run 61 61 00:02:08,380 --> 00:02:10,580 on that park's access control systems. 62 62 00:02:10,580 --> 00:02:13,130 Each day, the technician had to login and enter a code 63 63 00:02:13,130 --> 00:02:14,100 or a password. 64 64 00:02:14,100 --> 00:02:16,230 When he did that, a countdown clock reset 65 65 00:02:16,230 --> 00:02:17,650 for another 24 hours again, 66 66 00:02:17,650 --> 00:02:19,490 and the countdown began again. 67 67 00:02:19,490 --> 00:02:21,440 This way, if the clock ever reached zero, 68 68 00:02:21,440 --> 00:02:23,580 he code the system to unlock all the cages 69 69 00:02:23,580 --> 00:02:25,590 that hold the dinosaurs and they would run amuck 70 70 00:02:25,590 --> 00:02:26,910 and eat all the tourists. 71 71 00:02:26,910 --> 00:02:28,810 Now in the movie, spoiler alert, 72 72 00:02:28,810 --> 00:02:30,900 the technician goes missing because he gets killed 73 73 00:02:30,900 --> 00:02:32,750 by a dinosaur on one of these days. 74 74 00:02:32,750 --> 00:02:35,760 And then the entire park security system goes offline 75 75 00:02:35,760 --> 00:02:37,570 because of his script when it reached zero 76 76 00:02:37,570 --> 00:02:38,810 and it released all the animals 77 77 00:02:38,810 --> 00:02:41,150 and this leads to chaos for the rest of the movie. 78 78 00:02:41,150 --> 00:02:43,540 This is a classic example of a logic bomb 79 79 00:02:43,540 --> 00:02:44,710 since it's configured as, 80 80 00:02:44,710 --> 00:02:46,960 if the code isn't entered every 24 hours, 81 81 00:02:46,960 --> 00:02:50,240 then open all the cages and make bad things happen. 82 82 00:02:50,240 --> 00:02:52,150 Conversely, the attacker could have it set up 83 83 00:02:52,150 --> 00:02:56,000 that on a specific date, like February 29, 2024, 84 84 00:02:56,000 --> 00:02:58,430 the malware will launch and encrypt the entire hard drive 85 85 00:02:58,430 --> 00:03:00,645 of the server, or it's going to delete all the files 86 86 00:03:00,645 --> 00:03:03,200 or it's going to release all your confidential information 87 87 00:03:03,200 --> 00:03:04,580 to WikiLeaks or whatever. 88 88 00:03:04,580 --> 00:03:05,800 It really doesn't matter. 89 89 00:03:05,800 --> 00:03:08,280 But the case here is, we're dealing with some kind 90 90 00:03:08,280 --> 00:03:10,910 of an insider trying to cause bad things to happen 91 91 00:03:10,910 --> 00:03:11,943 on our networks.