1 00:00:00,020 --> 00:00:01,620 In this lesson, we're going to cover 2 00:00:01,620 --> 00:00:03,750 recognizing insider threats. 3 00:00:03,750 --> 00:00:05,160 Now, one of the most unpredictable 4 00:00:05,160 --> 00:00:06,660 and potentially dangerous aspects 5 00:00:06,660 --> 00:00:09,000 of security is the human element. 6 00:00:09,000 --> 00:00:10,380 You see, security isn't just 7 00:00:10,380 --> 00:00:12,240 about external hackers and malware. 8 00:00:12,240 --> 00:00:14,490 It's all about understanding and recognizing the risks 9 00:00:14,490 --> 00:00:16,980 that are posed by individuals within an organization 10 00:00:16,980 --> 00:00:19,470 that are often referred to as insider threats. 11 00:00:19,470 --> 00:00:22,050 These threats can be intentional or unintentional, 12 00:00:22,050 --> 00:00:23,820 and they can result from various factors 13 00:00:23,820 --> 00:00:26,310 including personnel issues, financial struggles, 14 00:00:26,310 --> 00:00:29,250 and their dissatisfaction with their own job. 15 00:00:29,250 --> 00:00:31,860 Because our employees can become a major threat area for us, 16 00:00:31,860 --> 00:00:33,600 it's really important that you train your users 17 00:00:33,600 --> 00:00:35,730 on how to recognize anomalous behavior, 18 00:00:35,730 --> 00:00:37,170 especially those who are demonstrating 19 00:00:37,170 --> 00:00:39,990 risky, unexpected, or unintentional behaviors 20 00:00:39,990 --> 00:00:41,670 that might flag a particular individual 21 00:00:41,670 --> 00:00:43,740 as a potential insider threat. 22 00:00:43,740 --> 00:00:45,030 Now, it is important to remember 23 00:00:45,030 --> 00:00:47,400 that a user's behavior can be a clear indication 24 00:00:47,400 --> 00:00:48,960 that there is something malicious going on 25 00:00:48,960 --> 00:00:50,640 inside of your organization. 26 00:00:50,640 --> 00:00:52,740 Changes in our user's behavior can signal 27 00:00:52,740 --> 00:00:54,480 an underlying issue that could translate 28 00:00:54,480 --> 00:00:56,760 into a future security risk for our systems 29 00:00:56,760 --> 00:00:58,440 and the data they contain. 30 00:00:58,440 --> 00:01:00,300 For example, if you have a coworker 31 00:01:00,300 --> 00:01:01,770 who shows up to work drunk 32 00:01:01,770 --> 00:01:04,590 or they're still severely hungover from the night before, 33 00:01:04,590 --> 00:01:06,630 this could be considered a risky behavior 34 00:01:06,630 --> 00:01:08,220 that is a sign that something isn't right 35 00:01:08,220 --> 00:01:10,020 inside of their personal lives. 36 00:01:10,020 --> 00:01:12,780 If this happens one time, maybe they just had a long weekend 37 00:01:12,780 --> 00:01:14,280 and partied a bit too much, 38 00:01:14,280 --> 00:01:15,600 but if you're seeing the same employee 39 00:01:15,600 --> 00:01:18,000 coming into work hungover every single day, 40 00:01:18,000 --> 00:01:19,830 this could be a sign of a major issue 41 00:01:19,830 --> 00:01:21,750 inside of their personal life. 42 00:01:21,750 --> 00:01:22,800 Now, why is this something 43 00:01:22,800 --> 00:01:25,710 that you need to consider as a cybersecurity professional? 44 00:01:25,710 --> 00:01:27,210 Well, if somebody is coming to work 45 00:01:27,210 --> 00:01:28,770 in an altered state like this, 46 00:01:28,770 --> 00:01:31,440 it can affect their productivity and their workplace safety 47 00:01:31,440 --> 00:01:33,330 as well as raising some significant concerns 48 00:01:33,330 --> 00:01:34,740 about their judgment. 49 00:01:34,740 --> 00:01:36,480 Their impaired state could also lead 50 00:01:36,480 --> 00:01:39,060 to unintended disclosure of sensitive information 51 00:01:39,060 --> 00:01:41,370 or the intentional misconduct that occurs, 52 00:01:41,370 --> 00:01:43,500 because of a compromised decision-making process 53 00:01:43,500 --> 00:01:45,210 inside of that individual. 54 00:01:45,210 --> 00:01:47,370 For example, I used to work for the US government 55 00:01:47,370 --> 00:01:48,750 and for many of our positions, 56 00:01:48,750 --> 00:01:51,420 we were required to maintain a security clearance. 57 00:01:51,420 --> 00:01:53,040 Now, personnel who are reporting for duty 58 00:01:53,040 --> 00:01:54,450 in an altered state like this 59 00:01:54,450 --> 00:01:55,950 were considered to be a huge risk, 60 00:01:55,950 --> 00:01:57,480 and they were flagged to have their personal lives 61 00:01:57,480 --> 00:01:59,370 investigate a little bit more in-depth, 62 00:01:59,370 --> 00:02:00,750 because the US government has learned 63 00:02:00,750 --> 00:02:02,730 that people who have a substance abuse problem 64 00:02:02,730 --> 00:02:05,610 are more likely to be coerced into making poor decisions 65 00:02:05,610 --> 00:02:07,470 like compromising the system security 66 00:02:07,470 --> 00:02:09,360 on behalf of another nation state 67 00:02:09,360 --> 00:02:12,480 or to sell government secrets to another nation state. 68 00:02:12,480 --> 00:02:14,430 Next, you should also look for any signs 69 00:02:14,430 --> 00:02:16,320 that somebody is emotionally distressed. 70 00:02:16,320 --> 00:02:17,340 An individual who starts 71 00:02:17,340 --> 00:02:18,900 giving away their personal possessions 72 00:02:18,900 --> 00:02:20,760 or starts to show signs of depression 73 00:02:20,760 --> 00:02:23,520 may be undergoing some severe emotional turmoil. 74 00:02:23,520 --> 00:02:24,810 Now, you might be wondering, 75 00:02:24,810 --> 00:02:26,850 how does this relate to security? 76 00:02:26,850 --> 00:02:29,700 Well, again, individuals in an emotional distress 77 00:02:29,700 --> 00:02:32,430 may not be as vigilant in following security protocols, 78 00:02:32,430 --> 00:02:34,710 which could lead to unintentional breaches. 79 00:02:34,710 --> 00:02:36,360 Worse yet, they might be vulnerable 80 00:02:36,360 --> 00:02:39,030 to exploitation by malicious parties, your competitors, 81 00:02:39,030 --> 00:02:41,880 or even a nation state actor who's trying to get an insider 82 00:02:41,880 --> 00:02:43,920 to help inside of their attacks. 83 00:02:43,920 --> 00:02:46,140 Therefore, it's always important that your management 84 00:02:46,140 --> 00:02:47,730 and your human resource departments 85 00:02:47,730 --> 00:02:50,040 are called in to help engage with any employees 86 00:02:50,040 --> 00:02:51,540 who may be suspected as being 87 00:02:51,540 --> 00:02:53,220 in an emotionally distressed state, 88 00:02:53,220 --> 00:02:55,620 because this needs to be done using empathy 89 00:02:55,620 --> 00:02:57,360 and offering support and assistance, 90 00:02:57,360 --> 00:02:59,550 while mitigating those potential security risks 91 00:02:59,550 --> 00:03:02,730 that this person is representing against your organization. 92 00:03:02,730 --> 00:03:05,730 Now, let's talk about your lifestyle incongruences. 93 00:03:05,730 --> 00:03:08,580 Now, this is a funny term that's used inside the exam. 94 00:03:08,580 --> 00:03:09,990 What we're really talking about here 95 00:03:09,990 --> 00:03:12,390 is when an employee is demonstrating a lifestyle 96 00:03:12,390 --> 00:03:13,440 that doesn't quite fit 97 00:03:13,440 --> 00:03:16,290 into their personal situation or financial structure. 98 00:03:16,290 --> 00:03:18,810 For example, if you're working as a system administrator 99 00:03:18,810 --> 00:03:20,670 who's making $80,000 per year, 100 00:03:20,670 --> 00:03:24,060 but you're driving around in a brand new $150,000 sports car 101 00:03:24,060 --> 00:03:25,860 and you're living in a $2 million home, 102 00:03:25,860 --> 00:03:27,030 this probably doesn't fit 103 00:03:27,030 --> 00:03:29,910 or align with your income or your financial structure. 104 00:03:29,910 --> 00:03:31,980 Now, does this kind of behavior automatically mean 105 00:03:31,980 --> 00:03:34,350 that, that person is going to be an insider threat, 106 00:03:34,350 --> 00:03:35,190 or that they're going to be selling 107 00:03:35,190 --> 00:03:37,590 your organization secrets to earn extra money? 108 00:03:37,590 --> 00:03:39,090 Well, no, not at all. 109 00:03:39,090 --> 00:03:40,890 Sometimes you're going to look into the person 110 00:03:40,890 --> 00:03:41,850 and realize that even though 111 00:03:41,850 --> 00:03:43,710 they only make $80,000 per year, 112 00:03:43,710 --> 00:03:45,030 they're married to a neurosurgeon 113 00:03:45,030 --> 00:03:47,310 who makes $750,000 per year, 114 00:03:47,310 --> 00:03:49,800 and so the car and the house are well within their ability 115 00:03:49,800 --> 00:03:51,480 to afford those expensive things, 116 00:03:51,480 --> 00:03:54,360 because of their total income inside of that household. 117 00:03:54,360 --> 00:03:56,760 But if you look into the employee's personal life 118 00:03:56,760 --> 00:03:58,590 and you find that they're a single individual 119 00:03:58,590 --> 00:03:59,580 and they come from a family 120 00:03:59,580 --> 00:04:01,170 who doesn't have a large amount of money, 121 00:04:01,170 --> 00:04:02,430 and they just bought both the car 122 00:04:02,430 --> 00:04:04,320 and the house within the last six months, 123 00:04:04,320 --> 00:04:05,670 and now, things are starting to get 124 00:04:05,670 --> 00:04:08,220 a little bit more scary for us as an organization, 125 00:04:08,220 --> 00:04:10,020 because this person might be involved 126 00:04:10,020 --> 00:04:12,210 in some illicit activities, some theft, 127 00:04:12,210 --> 00:04:13,790 or selling of your corporate secrets 128 00:04:13,790 --> 00:04:16,680 to be able to pay for all of these incongruencies. 129 00:04:16,680 --> 00:04:19,470 This behavior does require a discreet investigation 130 00:04:19,470 --> 00:04:21,360 to rule out any kind of foul play, 131 00:04:21,360 --> 00:04:23,550 while ensuring that you don't jump to conclusions 132 00:04:23,550 --> 00:04:25,410 or violate your employee's privacy, 133 00:04:25,410 --> 00:04:27,660 but it is something you have to be aware of. 134 00:04:27,660 --> 00:04:29,820 For example, if you work for the US government 135 00:04:29,820 --> 00:04:31,230 and you have a security clearance, 136 00:04:31,230 --> 00:04:32,460 you're going to be required to fill out 137 00:04:32,460 --> 00:04:35,490 a financial disclosure form whenever you're first hired. 138 00:04:35,490 --> 00:04:36,930 This document tells the government 139 00:04:36,930 --> 00:04:39,210 about you and your family's financial resources 140 00:04:39,210 --> 00:04:41,190 so they know what forms a normal baseline 141 00:04:41,190 --> 00:04:42,960 for your particular family. 142 00:04:42,960 --> 00:04:44,040 Now, if you happen to receive 143 00:04:44,040 --> 00:04:45,960 a large sum of money from an inheritance, 144 00:04:45,960 --> 00:04:48,030 you win a large cash prize at a casino, 145 00:04:48,030 --> 00:04:50,010 or you win a sweepstakes or lottery, 146 00:04:50,010 --> 00:04:51,540 you're going to be required to report that 147 00:04:51,540 --> 00:04:52,800 to the government so they know 148 00:04:52,800 --> 00:04:54,300 that it is now within your ability 149 00:04:54,300 --> 00:04:56,490 to buy that expensive house or that car, 150 00:04:56,490 --> 00:04:59,100 because of that unforeseen windfall that you just had 151 00:04:59,100 --> 00:05:01,620 that was outside of that normal baseline. 152 00:05:01,620 --> 00:05:03,420 Now, if you don't report the windfall, 153 00:05:03,420 --> 00:05:04,770 now the government might suspect 154 00:05:04,770 --> 00:05:06,120 some foul play on your part, 155 00:05:06,120 --> 00:05:07,323 and they might open an investigation 156 00:05:07,323 --> 00:05:09,540 into your finances and spending habits 157 00:05:09,540 --> 00:05:12,240 to determine if anything suspicious was actually occurring, 158 00:05:12,240 --> 00:05:15,270 or if you just got this money from someplace legally. 159 00:05:15,270 --> 00:05:17,250 While having too much money can be an indication 160 00:05:17,250 --> 00:05:18,390 that somebody has already done 161 00:05:18,390 --> 00:05:20,100 something illicit to gain that money, 162 00:05:20,100 --> 00:05:21,600 like selling corporate secrets, 163 00:05:21,600 --> 00:05:23,310 financial struggles on the other hand, 164 00:05:23,310 --> 00:05:25,050 are going to be the other end of the spectrum, 165 00:05:25,050 --> 00:05:27,240 and they're another red flag we have to consider. 166 00:05:27,240 --> 00:05:28,560 An employee who's drowning in debt 167 00:05:28,560 --> 00:05:29,910 might exhibit signs of stress 168 00:05:29,910 --> 00:05:31,320 or discuss their financial woes 169 00:05:31,320 --> 00:05:32,790 with some of their coworkers. 170 00:05:32,790 --> 00:05:35,430 This kind of financial stress is a security concern for us, 171 00:05:35,430 --> 00:05:37,350 because financial pressures can make individuals 172 00:05:37,350 --> 00:05:39,750 susceptible to bribery or it could tempt them 173 00:05:39,750 --> 00:05:41,880 into selling sensitive organizational information 174 00:05:41,880 --> 00:05:43,170 to your competitors. 175 00:05:43,170 --> 00:05:45,300 For this reason, it is vital that companies 176 00:05:45,300 --> 00:05:48,120 have policies in place for handling this kind of scenario, 177 00:05:48,120 --> 00:05:49,890 such as providing financial counseling options 178 00:05:49,890 --> 00:05:50,910 to the employee to help them 179 00:05:50,910 --> 00:05:52,800 overcome their financial difficulties, 180 00:05:52,800 --> 00:05:54,990 or by monitoring for unusual access 181 00:05:54,990 --> 00:05:56,670 or transmission of confidential data 182 00:05:56,670 --> 00:05:58,410 by the infected employee. 183 00:05:58,410 --> 00:06:01,440 So, how do we tackle these kinds of personal security issues 184 00:06:01,440 --> 00:06:02,550 without creating an environment 185 00:06:02,550 --> 00:06:04,650 of mistrust within our organization? 186 00:06:04,650 --> 00:06:06,300 Well, it all starts by establishing 187 00:06:06,300 --> 00:06:08,460 a robust insider threat program. 188 00:06:08,460 --> 00:06:10,440 Your insider threat program should promote 189 00:06:10,440 --> 00:06:12,480 a security culture that encourages employees 190 00:06:12,480 --> 00:06:14,220 to report suspicious activities, 191 00:06:14,220 --> 00:06:16,320 provides training to recognize warning signs, 192 00:06:16,320 --> 00:06:17,580 and implements policies that 193 00:06:17,580 --> 00:06:20,130 support mental health and financial well-being. 194 00:06:20,130 --> 00:06:23,070 The program must also ensure fair and confidential processes 195 00:06:23,070 --> 00:06:25,770 for investigating any potential insider threats. 196 00:06:25,770 --> 00:06:27,150 Organizations should also employ 197 00:06:27,150 --> 00:06:28,590 user activity monitoring tools 198 00:06:28,590 --> 00:06:30,600 to help in detecting anomalous behavior 199 00:06:30,600 --> 00:06:33,270 such as unusual access patterns, extensive copying 200 00:06:33,270 --> 00:06:34,830 or downloading of sensitive data, 201 00:06:34,830 --> 00:06:36,390 or working odd hours, 202 00:06:36,390 --> 00:06:37,920 because all of these could signify 203 00:06:37,920 --> 00:06:39,690 a potential insider threat. 204 00:06:39,690 --> 00:06:42,120 However, it's essential to balance security measures 205 00:06:42,120 --> 00:06:44,400 with the privacy rights of your employees. 206 00:06:44,400 --> 00:06:46,680 So remember, recognizing insider threats 207 00:06:46,680 --> 00:06:49,110 is all about paying attention to the warning signs 208 00:06:49,110 --> 00:06:50,340 and having procedures in place 209 00:06:50,340 --> 00:06:52,050 to handle them appropriately, 210 00:06:52,050 --> 00:06:53,760 while creating an environment where employees 211 00:06:53,760 --> 00:06:55,110 are comfortable seeking help 212 00:06:55,110 --> 00:06:56,940 and where the company takes proactive steps 213 00:06:56,940 --> 00:06:58,470 to mitigate your risks. 214 00:06:58,470 --> 00:07:00,270 Remember, a secure organization 215 00:07:00,270 --> 00:07:02,370 is not just one that has the best firewalls 216 00:07:02,370 --> 00:07:04,500 or the most robust encryption mechanisms, 217 00:07:04,500 --> 00:07:07,320 but it is the organization that is looking after its people, 218 00:07:07,320 --> 00:07:10,350 because they understand that security starts from within. 219 00:07:10,350 --> 00:07:11,910 As cybersecurity professionals, 220 00:07:11,910 --> 00:07:14,190 we must always remain vigilant, empathetic, 221 00:07:14,190 --> 00:07:15,750 and proactive in recognizing 222 00:07:15,750 --> 00:07:18,480 and managing the human aspect of security threats. 223 00:07:18,480 --> 00:07:19,890 This approach not only safeguard 224 00:07:19,890 --> 00:07:21,540 sensitive information and assets, 225 00:07:21,540 --> 00:07:23,970 but also, fosters a supportive work environment 226 00:07:23,970 --> 00:07:25,890 that is essential for the holistic well-being 227 00:07:25,890 --> 00:07:27,123 of your organization.