In this lesson, we're going to cover
recognizing insider threats.
Now, one of the most unpredictable
and potentially dangerous aspects
of security is the human element.
You see, security isn't just
about external hackers and malware.
It's all about understanding and recognizing the risks
that are posed by individuals within an organization
that are often referred to as insider threats.
These threats can be intentional or unintentional,
and they can result from various factors
including personnel issues, financial struggles,
and their dissatisfaction with their own job.
Because our employees can become a major threat area for us,
it's really important that you train your users
on how to recognize anomalous behavior,
especially those who are demonstrating
risky, unexpected, or unintentional behaviors
that might flag a particular individual
as a potential insider threat.
Now, it is important to remember
that a user's behavior can be a clear indication
that there is something malicious going on
inside of your organization.
Changes in our user's behavior can signal
an underlying issue that could translate
into a future security risk for our systems
and the data they contain.
For example, if you have a coworker
who shows up to work drunk
or they're still severely hungover from the night before,
this could be considered a risky behavior
that is a sign that something isn't right
inside of their personal lives.
If this happens one time, maybe they just had a long weekend
and partied a bit too much,
but if you're seeing the same employee
coming into work hungover every single day,
this could be a sign of a major issue
inside of their personal life.
Now, why is this something
that you need to consider as a cybersecurity professional?
Well, if somebody is coming to work
in an altered state like this,
it can affect their productivity and their workplace safety
as well as raising some significant concerns
about their judgment.
Their impaired state could also lead
to unintended disclosure of sensitive information
or the intentional misconduct that occurs,
because of a compromised decision-making process
inside of that individual.
For example, I used to work for the US government
and for many of our positions,
we were required to maintain a security clearance.
Now, personnel who are reporting for duty
in an altered state like this
were considered to be a huge risk,
and they were flagged to have their personal lives
investigate a little bit more in-depth,
because the US government has learned
that people who have a substance abuse problem
are more likely to be coerced into making poor decisions
like compromising the system security
on behalf of another nation state
or to sell government secrets to another nation state.
Next, you should also look for any signs
that somebody is emotionally distressed.
An individual who starts
giving away their personal possessions
or starts to show signs of depression
may be undergoing some severe emotional turmoil.
Now, you might be wondering,
how does this relate to security?
Well, again, individuals in an emotional distress
may not be as vigilant in following security protocols,
which could lead to unintentional breaches.
Worse yet, they might be vulnerable
to exploitation by malicious parties, your competitors,
or even a nation state actor who's trying to get an insider
to help inside of their attacks.
Therefore, it's always important that your management
and your human resource departments
are called in to help engage with any employees
who may be suspected as being
in an emotionally distressed state,
because this needs to be done using empathy
and offering support and assistance,
while mitigating those potential security risks
that this person is representing against your organization.
Now, let's talk about your lifestyle incongruences.
Now, this is a funny term that's used inside the exam.
What we're really talking about here
is when an employee is demonstrating a lifestyle
that doesn't quite fit
into their personal situation or financial structure.
For example, if you're working as a system administrator
who's making $80,000 per year,
but you're driving around in a brand new $150,000 sports car
and you're living in a $2 million home,
this probably doesn't fit
or align with your income or your financial structure.
Now, does this kind of behavior automatically mean
that, that person is going to be an insider threat,
or that they're going to be selling
your organization secrets to earn extra money?
Well, no, not at all.
Sometimes you're going to look into the person
and realize that even though
they only make $80,000 per year,
they're married to a neurosurgeon
who makes $750,000 per year,
and so the car and the house are well within their ability
to afford those expensive things,
because of their total income inside of that household.
But if you look into the employee's personal life
and you find that they're a single individual
and they come from a family
who doesn't have a large amount of money,
and they just bought both the car
and the house within the last six months,
and now, things are starting to get
a little bit more scary for us as an organization,
because this person might be involved
in some illicit activities, some theft,
or selling of your corporate secrets
to be able to pay for all of these incongruencies.
This behavior does require a discreet investigation
to rule out any kind of foul play,
while ensuring that you don't jump to conclusions
or violate your employee's privacy,
but it is something you have to be aware of.
For example, if you work for the US government
and you have a security clearance,
you're going to be required to fill out
a financial disclosure form whenever you're first hired.
This document tells the government
about you and your family's financial resources
so they know what forms a normal baseline
for your particular family.
Now, if you happen to receive
a large sum of money from an inheritance,
you win a large cash prize at a casino,
or you win a sweepstakes or lottery,
you're going to be required to report that
to the government so they know
that it is now within your ability
to buy that expensive house or that car,
because of that unforeseen windfall that you just had
that was outside of that normal baseline.
Now, if you don't report the windfall,
now the government might suspect
some foul play on your part,
and they might open an investigation
into your finances and spending habits
to determine if anything suspicious was actually occurring,
or if you just got this money from someplace legally.
While having too much money can be an indication
that somebody has already done
something illicit to gain that money,
like selling corporate secrets,
financial struggles on the other hand,
are going to be the other end of the spectrum,
and they're another red flag we have to consider.
An employee who's drowning in debt
might exhibit signs of stress
or discuss their financial woes
with some of their coworkers.
This kind of financial stress is a security concern for us,
because financial pressures can make individuals
susceptible to bribery or it could tempt them
into selling sensitive organizational information
to your competitors.
For this reason, it is vital that companies
have policies in place for handling this kind of scenario,
such as providing financial counseling options
to the employee to help them
overcome their financial difficulties,
or by monitoring for unusual access
or transmission of confidential data
by the infected employee.
So, how do we tackle these kinds of personal security issues
without creating an environment
of mistrust within our organization?
Well, it all starts by establishing
a robust insider threat program.
Your insider threat program should promote
a security culture that encourages employees
to report suspicious activities,
provides training to recognize warning signs,
and implements policies that
support mental health and financial well-being.
The program must also ensure fair and confidential processes
for investigating any potential insider threats.
Organizations should also employ
user activity monitoring tools
to help in detecting anomalous behavior
such as unusual access patterns, extensive copying
or downloading of sensitive data,
or working odd hours,
because all of these could signify
a potential insider threat.
However, it's essential to balance security measures
with the privacy rights of your employees.
So remember, recognizing insider threats
is all about paying attention to the warning signs
and having procedures in place
to handle them appropriately,
while creating an environment where employees
are comfortable seeking help
and where the company takes proactive steps
to mitigate your risks.
Remember, a secure organization
is not just one that has the best firewalls
or the most robust encryption mechanisms,
but it is the organization that is looking after its people,
because they understand that security starts from within.
As cybersecurity professionals,
we must always remain vigilant, empathetic,
and proactive in recognizing
and managing the human aspect of security threats.
This approach not only safeguard
sensitive information and assets,
but also, fosters a supportive work environment
that is essential for the holistic well-being
of your organization.