-: Insider Threat. 2 2
In this lesson, we're going to discuss 3 3
the risk of an insider threat. 4 4
Now, an insider threat is an employee 5 5
or other trusted insider, such as a contractor, supplier 6 6
or business partner who uses their authorized network access 7 7
in unauthorized ways to cause harm to your company. 8 8
For example, if Tom in sales decides he's going to 9 9
download an entire copy of 10 10
our customer relationship management database, 11 11
and he takes it home with him to sell it 12 12
to one of our competitors, then Tom is an insider threat. 13 13
Now insider threats are one of the most dangerous threats 14 14
to your organization 15 15
because they are very difficult to find and stop 16 16
from a technical network perspective. 17 17
After all, these are people who have authorized credentials 18 18
to log onto the network and use all the different servers 19 19
and applications that you provide. 20 20
They have a valid username and password 21 21
so they can do their job. 22 22
But if they're not trustworthy, they can also use 23 23
that same access to harm your company and harm your network. 24 24
So what is the best way to catch an insider threat? 25 25
Well, it's by conducting observation of employees 26 26
while they're logged in 27 27
and enforcing a culture of questioning fellow employees. 28 28
After all, if another employee sees somebody 29 29
doing some weird things 30 30
like downloading large quantities of data at weird times 31 31
of the day, you want them to ask, 32 32
hey, what are you doing and why, 33 33
so you can determine if there's a legitimate business need, 34 34
or is this an insider threat at work. 35 35
Now I've worked at organizations where we've had employees 36 36
who were very vocal about their dislike of the organization 37 37
and how they wanted to see the organization fail 38 38
or get hurt. 39 39
Now, once I found out about this, 40 40
we carefully had to invite them to leave the organization 41 41
because their services were no longer required 42 42
and we couldn't trust them on our network. 43 43
Because if they're that angry with the company, 44 44
we don't want them hurting our company 45 45
by stealing our information. 46 46
Now, a great example of an insider threat 47 47
comes from the original "Jurassic Park" movie. 48 48
In that movie, they use a logic bomb 49 49
to cause harm to the park. 50 50
Now, a logic bomb is a specific type of malware 51 51
that's tied to either a logical event or a specific time. 52 52
In this case, we had a disgruntled IT administrator 53 53
and they would be an insider threat. 54 54
And they decided that they're going to make sure 55 55
that when they leave the company, 56 56
the company is going to regret it. 57 57
So going back to this example of the "Jurassic Park" movie, 58 58
there was an IT administrator who worked for the park 59 59
that housed all the dinosaurs. 60 60
He decided to create a script that would continually run 61 61
on that park's access control systems. 62 62
Each day, the technician had to login and enter a code 63 63
or a password. 64 64
When he did that, a countdown clock reset 65 65
for another 24 hours again, 66 66
and the countdown began again. 67 67
This way, if the clock ever reached zero, 68 68
he code the system to unlock all the cages 69 69
that hold the dinosaurs and they would run amuck 70 70
and eat all the tourists. 71 71
Now in the movie, spoiler alert, 72 72
the technician goes missing because he gets killed 73 73
by a dinosaur on one of these days. 74 74
And then the entire park security system goes offline 75 75
because of his script when it reached zero 76 76
and it released all the animals 77 77
and this leads to chaos for the rest of the movie. 78 78
This is a classic example of a logic bomb 79 79
since it's configured as, 80 80
if the code isn't entered every 24 hours, 81 81
then open all the cages and make bad things happen. 82 82
Conversely, the attacker could have it set up 83 83
that on a specific date, like February 29, 2024, 84 84
the malware will launch and encrypt the entire hard drive 85 85
of the server, or it's going to delete all the files 86 86
or it's going to release all your confidential information 87 87
to WikiLeaks or whatever. 88 88
It really doesn't matter. 89 89
But the case here is, we're dealing with some kind 90 90
of an insider trying to cause bad things to happen 91 91
on our networks.