1
00:00:06,570 --> 00:00:07,950
- Welcome to lesson five,

2
00:00:07,950 --> 00:00:11,670
compare and contrast common
threat actors and motivations.

3
00:00:11,670 --> 00:00:13,590
In this lesson, we're gonna focus in

4
00:00:13,590 --> 00:00:16,020
on who those threat actors are

5
00:00:16,020 --> 00:00:19,380
and attributes that we
understand their motivation

6
00:00:19,380 --> 00:00:22,683
and how they work and why they
do the things that they do.

7
00:00:23,970 --> 00:00:25,830
But before we talk about threat actors,

8
00:00:25,830 --> 00:00:27,480
let's just do a threat primer.

9
00:00:27,480 --> 00:00:29,310
Some of this is review,
but I wanna make sure

10
00:00:29,310 --> 00:00:32,400
that we're using
terminology in the same way.

11
00:00:32,400 --> 00:00:37,230
So let's review threats,
vulnerabilities, and exploit.

12
00:00:37,230 --> 00:00:40,740
A threat is a category of
objects, persons, processes

13
00:00:40,740 --> 00:00:44,066
or events that represent
a potential danger

14
00:00:44,066 --> 00:00:45,690
and that's the key

15
00:00:45,690 --> 00:00:50,690
that it represents a
potential danger to an asset.

16
00:00:51,000 --> 00:00:53,070
Next, we have vulnerabilities.

17
00:00:53,070 --> 00:00:56,460
Now, a vulnerability is
a weakness in a system,

18
00:00:56,460 --> 00:00:58,530
in a process, in a person.

19
00:00:58,530 --> 00:01:00,810
Could also be in a
building, in infrastructure,

20
00:01:00,810 --> 00:01:03,660
that can be exploited by a threat.

21
00:01:03,660 --> 00:01:06,600
So vulnerability is our weakness.

22
00:01:06,600 --> 00:01:09,600
And then lastly, we have an exploit.

23
00:01:09,600 --> 00:01:11,610
An exploit is where our threat actor

24
00:01:11,610 --> 00:01:15,039
successfully takes advantage
of the vulnerability.

25
00:01:15,039 --> 00:01:17,008
That's when they're doing
their really nasty things.

26
00:01:17,008 --> 00:01:19,290
They're looking to do us harm.

27
00:01:19,290 --> 00:01:22,890
So a threat is a danger, a
vulnerability is a weakness

28
00:01:22,890 --> 00:01:26,730
and exploit is when our
threat actor takes advantage

29
00:01:26,730 --> 00:01:29,733
successfully takes advantage
of the vulnerability.

30
00:01:31,320 --> 00:01:34,290
So before I actually introduce
you to our threat actors

31
00:01:34,290 --> 00:01:37,140
or adversaries, let's do adversary primer.

32
00:01:37,140 --> 00:01:40,980
A threat actor agent, a targeted attack,

33
00:01:40,980 --> 00:01:43,380
and an opportunistic attack.

34
00:01:43,380 --> 00:01:45,960
Now, an adversary is an opponent.

35
00:01:45,960 --> 00:01:48,660
A threat actor is going to be an adversary

36
00:01:48,660 --> 00:01:50,760
with malicious intent, right?

37
00:01:50,760 --> 00:01:52,623
They want to do some harm.

38
00:01:53,550 --> 00:01:56,400
Now, our adversaries or
our threat actors, right?

39
00:01:56,400 --> 00:01:58,230
Really have two approaches.

40
00:01:58,230 --> 00:02:01,770
They can either approach us
as a targeted attack victim

41
00:02:01,770 --> 00:02:04,410
or an opportunistic attack victim.

42
00:02:04,410 --> 00:02:06,480
So let's define a targeted attack

43
00:02:06,480 --> 00:02:08,700
and an opportunistic attack.

44
00:02:08,700 --> 00:02:12,120
A targeted attack is when our
threat actor chooses a target

45
00:02:12,120 --> 00:02:14,190
for a specific objective.

46
00:02:14,190 --> 00:02:16,830
So they know they're coming
after you specifically

47
00:02:16,830 --> 00:02:19,800
and the choice of that target
is generally influenced

48
00:02:19,800 --> 00:02:21,780
by the perceived value of the outcome.

49
00:02:21,780 --> 00:02:23,460
They don't know what your weaknesses are,

50
00:02:23,460 --> 00:02:24,930
they don't know how they're necessarily

51
00:02:24,930 --> 00:02:27,780
going to be successful in their attack,

52
00:02:27,780 --> 00:02:29,820
but they know they wanna come after you.

53
00:02:29,820 --> 00:02:32,160
So very specific.

54
00:02:32,160 --> 00:02:34,249
That's different than
an opportunistic attack.

55
00:02:34,249 --> 00:02:36,090
In an opportunistic attack,

56
00:02:36,090 --> 00:02:39,510
the threat actor takes
advantage of a vulnerable target

57
00:02:39,510 --> 00:02:42,120
perhaps not previously
ever even known to them.

58
00:02:42,120 --> 00:02:43,560
Now, the choice of their target

59
00:02:43,560 --> 00:02:46,620
is going to be generally
influenced by the work factor.

60
00:02:46,620 --> 00:02:48,420
So let me give you a couple examples.

61
00:02:48,420 --> 00:02:49,740
In the physical world,

62
00:02:49,740 --> 00:02:50,610
maybe there's a robber

63
00:02:50,610 --> 00:02:53,280
who wants to rob a store on Main Street.

64
00:02:53,280 --> 00:02:54,630
He gets to the first store

65
00:02:54,630 --> 00:02:56,340
and it's really well lit up

66
00:02:56,340 --> 00:02:59,040
and looks like there's a a CCTV camera.

67
00:02:59,040 --> 00:03:00,690
They're like, "I'm not doing that one."

68
00:03:00,690 --> 00:03:04,200
Goes to the next door,
and boy, big deadbolts

69
00:03:04,200 --> 00:03:06,810
and, "Oh, looks like there's
even a security guard.

70
00:03:06,810 --> 00:03:08,220
Not doing that one."

71
00:03:08,220 --> 00:03:11,443
Gets the next one, alarms
really well lit up.

72
00:03:11,443 --> 00:03:14,190
I mean, it looks like
it's tight put together.

73
00:03:14,190 --> 00:03:16,680
Well, probably not a good chance

74
00:03:16,680 --> 00:03:18,660
of being successful there either.

75
00:03:18,660 --> 00:03:21,540
Gets to the fourth one,
no security guard around,

76
00:03:21,540 --> 00:03:24,120
doesn't look like there's a CCTV camera,

77
00:03:24,120 --> 00:03:25,830
doesn't look like there's an alarm.

78
00:03:25,830 --> 00:03:28,470
The lock looks like, "Oh, I
could probably get through it.

79
00:03:28,470 --> 00:03:31,110
Aha, there's the opportunity."

80
00:03:31,110 --> 00:03:33,669
So that's the victim that
the attacker chooses.

81
00:03:33,669 --> 00:03:36,273
That's an opportunistic attack.

82
00:03:37,260 --> 00:03:39,960
You know, in the digital
world, it could be as simple

83
00:03:39,960 --> 00:03:43,170
as our attackers are
scanning the internet,

84
00:03:43,170 --> 00:03:45,570
they're looking for open
ports, they're looking

85
00:03:45,570 --> 00:03:48,051
for organizations or infrastructures

86
00:03:48,051 --> 00:03:50,017
that don't particularly
look very well locked down.

87
00:03:50,017 --> 00:03:53,880
They say, "Oh, that would
be an opportunistic target."

88
00:03:53,880 --> 00:03:55,590
So in a targeted attack, right,

89
00:03:55,590 --> 00:03:58,440
the attacker's going right
after that target, right?

90
00:03:58,440 --> 00:04:01,170
Generally influenced by the
perceived value of the outcome.

91
00:04:01,170 --> 00:04:03,360
In an opportunistic attack, the choice

92
00:04:03,360 --> 00:04:05,610
of the target is going to
be generally influenced

93
00:04:05,610 --> 00:04:07,140
by the work factor, right?

94
00:04:07,140 --> 00:04:09,090
How much time and effort and resources

95
00:04:09,090 --> 00:04:12,363
do they have to put in to be
successful in that attack?

96
00:04:15,060 --> 00:04:18,120
So let's talk about our
cyber threat actors.

97
00:04:18,120 --> 00:04:20,040
We have a whole pan on them.

98
00:04:20,040 --> 00:04:22,620
We might have a just a lone skilled

99
00:04:22,620 --> 00:04:25,653
or unskilled attacker kind
of just working on their own.

100
00:04:26,820 --> 00:04:27,653
We could have a hacktivist.

101
00:04:27,653 --> 00:04:30,120
Now a hacktivist is really interested

102
00:04:30,120 --> 00:04:32,520
in making a political statement.

103
00:04:32,520 --> 00:04:34,770
Favorite activities of a hacktivist

104
00:04:34,770 --> 00:04:38,070
is going to be doing a defacing a website

105
00:04:38,070 --> 00:04:41,013
or a distributed denial of service attack.

106
00:04:42,300 --> 00:04:43,650
We could have organized crime

107
00:04:43,650 --> 00:04:45,780
that we refer to as cyber criminals.

108
00:04:45,780 --> 00:04:49,560
And these are criminals who
are out to make money, right?

109
00:04:49,560 --> 00:04:52,200
Money is, you know, their real motivation.

110
00:04:52,200 --> 00:04:55,800
And this is an area that's scary

111
00:04:55,800 --> 00:04:58,470
because they're very, very well-organized.

112
00:04:58,470 --> 00:05:02,250
There's an incredible
cyber criminal ecosystem

113
00:05:02,250 --> 00:05:04,803
and they put a lot of money into R&D.

114
00:05:06,060 --> 00:05:07,320
We have nation states.

115
00:05:07,320 --> 00:05:08,550
So it could be nation states

116
00:05:08,550 --> 00:05:11,850
who are looking to disrupt another nation.

117
00:05:11,850 --> 00:05:13,350
It could be to cause some harm,

118
00:05:13,350 --> 00:05:16,020
it could be to steal some
intellectual property,

119
00:05:16,020 --> 00:05:18,600
it could be to steal
some military secrets,

120
00:05:18,600 --> 00:05:20,883
or it could be just to instill fear.

121
00:05:23,010 --> 00:05:25,020
We have insiders, right?

122
00:05:25,020 --> 00:05:29,130
Insiders who, you know, may
feel like they have a grievance

123
00:05:29,130 --> 00:05:30,930
or there's a moral obligation,

124
00:05:30,930 --> 00:05:32,400
there's something that they think is wrong

125
00:05:32,400 --> 00:05:34,360
and they've brought it to
the attention of management

126
00:05:34,360 --> 00:05:36,270
and they've been ignored.

127
00:05:36,270 --> 00:05:39,900
Or maybe they're someone
who is really under duress

128
00:05:39,900 --> 00:05:43,110
and so they're being pressured
into taking an action.

129
00:05:43,110 --> 00:05:45,900
Or it could be really
as simple as shadow IT

130
00:05:45,900 --> 00:05:50,250
which is using technology
sort of outside of the sphere

131
00:05:50,250 --> 00:05:51,510
of the IT department

132
00:05:51,510 --> 00:05:54,033
so they haven't applied
the appropriate controls.

133
00:05:55,080 --> 00:05:56,940
And then we have competitors.

134
00:05:56,940 --> 00:05:59,778
Competitors really want
to do one of two things.

135
00:05:59,778 --> 00:06:02,700
Either they'd like to get
intellectual property,

136
00:06:02,700 --> 00:06:04,260
so learn what you're doing,

137
00:06:04,260 --> 00:06:06,870
or, and we see this a
lot in gaming and retail,

138
00:06:06,870 --> 00:06:09,240
knock the other site offline.

139
00:06:09,240 --> 00:06:10,800
Because if you can knock a gaming site

140
00:06:10,800 --> 00:06:12,540
or a retail site offline,

141
00:06:12,540 --> 00:06:14,700
it's a good chance that those customers

142
00:06:14,700 --> 00:06:18,060
or those players will go to another site

143
00:06:18,060 --> 00:06:20,913
develop loyalty at the other
site, and not come back.

144
00:06:22,110 --> 00:06:24,480
So lone skilled or unskilled attackers,

145
00:06:24,480 --> 00:06:27,630
hacktivists, organized
crime, nation states,

146
00:06:27,630 --> 00:06:30,390
insiders, and competitors.

147
00:06:30,390 --> 00:06:31,819
But that's a lot of threat actors.

148
00:06:31,819 --> 00:06:33,540
That's the bad news.

149
00:06:33,540 --> 00:06:36,090
The good news is that generally speaking,

150
00:06:36,090 --> 00:06:38,550
they all use the same
tools and techniques.

151
00:06:38,550 --> 00:06:40,230
They're all looking to exploit

152
00:06:40,230 --> 00:06:42,107
relatively the same vulnerabilities.

153
00:06:42,107 --> 00:06:45,420
They're just doing it to different
levels of sophistication.

154
00:06:45,420 --> 00:06:49,560
So as we learn to defend against
one of these threat actors,

155
00:06:49,560 --> 00:06:52,383
we actually are learning to
defend against all of them.

156
00:06:53,820 --> 00:06:55,170
So let's dive a little bit more

157
00:06:55,170 --> 00:06:57,240
into their means and motive.

158
00:06:57,240 --> 00:06:58,170
So we talked about

159
00:06:58,170 --> 00:07:01,170
these lone skilled or unskilled attackers.

160
00:07:01,170 --> 00:07:02,370
Our unskilled detectives,

161
00:07:02,370 --> 00:07:04,590
we often refer to as script kitties.

162
00:07:04,590 --> 00:07:05,670
Now, script kitties are those

163
00:07:05,670 --> 00:07:07,560
who don't have any coding skills,

164
00:07:07,560 --> 00:07:09,030
maybe not have any cyber skills

165
00:07:09,030 --> 00:07:10,920
they're just bringing down
tools from the internet.

166
00:07:10,920 --> 00:07:13,170
They know how to go to the
internet, maybe to the dark web.

167
00:07:13,170 --> 00:07:14,280
They bring down a tool

168
00:07:14,280 --> 00:07:16,560
and they're out there trying to attack.

169
00:07:16,560 --> 00:07:18,990
Often, they don't even
understand all the consequences

170
00:07:18,990 --> 00:07:21,420
or ramifications of what they're doing.

171
00:07:21,420 --> 00:07:22,380
Why do they do it?

172
00:07:22,380 --> 00:07:24,780
Usually bragging rights and notoriety.

173
00:07:24,780 --> 00:07:25,890
But they have generally,

174
00:07:25,890 --> 00:07:28,383
a pretty low level of sophistication.

175
00:07:29,850 --> 00:07:30,870
Then we have hackers.

176
00:07:30,870 --> 00:07:33,390
Now, hackers, now we're
talking not ethical hackers,

177
00:07:33,390 --> 00:07:35,010
not those who hire to do good things

178
00:07:35,010 --> 00:07:38,610
but these are hackers
with not so great intent.

179
00:07:38,610 --> 00:07:40,680
You know, very often
what they're looking for

180
00:07:40,680 --> 00:07:42,540
is some financial gain, right?

181
00:07:42,540 --> 00:07:44,940
They wanna say to a
company, "Hey, you know,

182
00:07:44,940 --> 00:07:48,090
I can exploit you unless
you pay me an amount."

183
00:07:48,090 --> 00:07:49,267
Notoriety.

184
00:07:49,267 --> 00:07:51,753
But generally, they're very talented.

185
00:07:53,190 --> 00:07:54,023
And then we have hacktivists.

186
00:07:54,023 --> 00:07:57,000
And the hacktivists usually
aren't a single person.

187
00:07:57,000 --> 00:07:58,140
A hacktivist usually works

188
00:07:58,140 --> 00:08:01,200
in a group or as a
collective, like Anonymous.

189
00:08:01,200 --> 00:08:03,478
They wanna make a political statement.

190
00:08:03,478 --> 00:08:06,420
Generally, they've got some talent.

191
00:08:06,420 --> 00:08:08,220
Their funding is kind of variable.

192
00:08:08,220 --> 00:08:09,510
But as I mentioned before, again,

193
00:08:09,510 --> 00:08:11,130
they're trying to make a statement

194
00:08:11,130 --> 00:08:14,010
and they really have two
favorite avenues of attack,

195
00:08:14,010 --> 00:08:15,330
doing denial of service

196
00:08:15,330 --> 00:08:17,190
or distributed denial of service attacks

197
00:08:17,190 --> 00:08:18,963
or defacing a website.

198
00:08:20,161 --> 00:08:21,960
Then we go to our cyber criminals.

199
00:08:21,960 --> 00:08:24,210
Again, financial gain,
and that's their motive.

200
00:08:24,210 --> 00:08:27,090
They're well organized,
they're sophisticated,

201
00:08:27,090 --> 00:08:28,713
and they're very well-funded.

202
00:08:30,300 --> 00:08:31,320
Nation states.

203
00:08:31,320 --> 00:08:33,390
There's a whole bunch of
reasons why nation states

204
00:08:33,390 --> 00:08:35,010
might be attacking.

205
00:08:35,010 --> 00:08:40,010
Surveillance, espionage,
disruption, war, all motivations.

206
00:08:40,456 --> 00:08:44,010
They're very well-organized,
they're sophisticated.

207
00:08:44,010 --> 00:08:46,440
Generally, they are well-funded.

208
00:08:46,440 --> 00:08:49,110
They can be stealthy
because on the most part,

209
00:08:49,110 --> 00:08:51,630
nation states have the
luxury of time, right?

210
00:08:51,630 --> 00:08:53,100
They can build up an attack

211
00:08:53,100 --> 00:08:56,613
over days, weeks, months, even years.

212
00:08:58,320 --> 00:09:01,440
Our insiders, grievance, revenge,

213
00:09:01,440 --> 00:09:05,100
a perceived morality
issue, duress, blackmail.

214
00:09:05,100 --> 00:09:07,770
A whole bunch of different
reasons why insiders

215
00:09:07,770 --> 00:09:09,300
might cause trouble for us.

216
00:09:09,300 --> 00:09:11,448
And they have a variable
level of sophistication

217
00:09:11,448 --> 00:09:13,590
and funding, really
depending on who they are.

218
00:09:13,590 --> 00:09:14,423
It could be anyone

219
00:09:14,423 --> 00:09:17,703
from a IT administrator to
perhaps our bank teller.

220
00:09:19,650 --> 00:09:24,000
Shadow IT was when someone is
trying to accomplish a task

221
00:09:24,000 --> 00:09:26,250
but they're bypassing the controls

222
00:09:26,250 --> 00:09:28,230
that the IT group would put in place.

223
00:09:28,230 --> 00:09:30,667
We'll be talking more about
shadow IT in just a little bit.

224
00:09:30,667 --> 00:09:32,520
There's no malice there,

225
00:09:32,520 --> 00:09:34,410
but they are circumventing the controls

226
00:09:34,410 --> 00:09:37,440
and that could cause problems for us.

227
00:09:37,440 --> 00:09:39,180
And then of course, our competitors.

228
00:09:39,180 --> 00:09:42,450
Espionage, IP theft, service disruption,

229
00:09:42,450 --> 00:09:44,310
reputational damage.

230
00:09:44,310 --> 00:09:47,177
Generally, if a competitor
is going to come after you,

231
00:09:47,177 --> 00:09:49,080
they're usually pretty sophisticated

232
00:09:49,080 --> 00:09:51,420
or hired some pretty sophisticated folks

233
00:09:51,420 --> 00:09:53,670
and they are well-funded.

234
00:09:53,670 --> 00:09:55,410
So that's some means and motive

235
00:09:55,410 --> 00:09:57,633
for all of these different threat actors.

236
00:09:58,650 --> 00:10:01,200
Now, there are also some
non adversarial threats.

237
00:10:01,200 --> 00:10:03,240
Remember, an adversary was an opponent.

238
00:10:03,240 --> 00:10:05,055
So this is a non-opponent type of threat

239
00:10:05,055 --> 00:10:08,970
that could cause harm to our organization.

240
00:10:08,970 --> 00:10:11,880
There are natural non-adversarial threats.

241
00:10:11,880 --> 00:10:14,790
natural occurrences like
earthquakes and storms and floods.

242
00:10:14,790 --> 00:10:16,980
Environmental events like pollution

243
00:10:16,980 --> 00:10:19,260
and sea rise or public health emergencies

244
00:10:19,260 --> 00:10:22,350
like the pandemic that
we've all gone through.

245
00:10:22,350 --> 00:10:25,170
There are operational
non-adversarial threats,

246
00:10:25,170 --> 00:10:28,110
loss of services like electricity or HVAC,

247
00:10:28,110 --> 00:10:30,030
or technical issues like equipment

248
00:10:30,030 --> 00:10:31,593
or communications failure.

249
00:10:32,640 --> 00:10:35,760
And lastly, human non-adversarial threats.

250
00:10:35,760 --> 00:10:36,900
Things like accidents

251
00:10:36,900 --> 00:10:40,470
or civil disturbances or work shortages.

252
00:10:40,470 --> 00:10:42,450
But even though they're non-adversarial

253
00:10:42,450 --> 00:10:43,950
doesn't mean they're not a danger.

254
00:10:43,950 --> 00:10:46,023
So we still have to prepare for them.

255
00:10:48,720 --> 00:10:51,840
And that, my friends, brings
us to a three second challenge.

256
00:10:51,840 --> 00:10:52,980
You know how to do this.

257
00:10:52,980 --> 00:10:55,230
Five challenge questions,
three seconds each.

258
00:10:55,230 --> 00:10:56,063
Let's do it.

259
00:10:57,450 --> 00:10:59,490
The term used to describe
when a threat agent

260
00:10:59,490 --> 00:11:02,313
successfully takes advantage
of a vulnerability.

261
00:11:03,180 --> 00:11:05,523
One, two, three.

262
00:11:06,990 --> 00:11:08,340
That's gonna be an exploit.

263
00:11:10,042 --> 00:11:11,430
Number two.

264
00:11:11,430 --> 00:11:13,290
The primary characteristic of this attack

265
00:11:13,290 --> 00:11:15,120
is a threat actor identifying

266
00:11:15,120 --> 00:11:17,163
a vulnerable target for exploit.

267
00:11:18,660 --> 00:11:20,130
So the threat actor

268
00:11:20,130 --> 00:11:21,870
for seeing they're doing is identifying

269
00:11:21,870 --> 00:11:24,990
a vulnerable target that
they're going to exploit.

270
00:11:24,990 --> 00:11:27,840
One, two, three.

271
00:11:27,840 --> 00:11:30,003
It's gonna be an opportunistic attack.

272
00:11:31,380 --> 00:11:32,700
Number three.

273
00:11:32,700 --> 00:11:36,240
IP theft, reputation,
damage and disruption

274
00:11:36,240 --> 00:11:39,540
are this attacker's group's motivation.

275
00:11:39,540 --> 00:11:42,993
IP theft, reputation damage, disruption.

276
00:11:44,370 --> 00:11:45,960
Of the attacker groups
that we talked about,

277
00:11:45,960 --> 00:11:49,560
which one of them is
this their motivation?

278
00:11:49,560 --> 00:11:51,273
One, two, three.

279
00:11:52,530 --> 00:11:54,130
That's gonna be our competitors.

280
00:11:55,590 --> 00:11:56,760
Number four.

281
00:11:56,760 --> 00:12:00,030
Highly motivated, well-funded adversary

282
00:12:00,030 --> 00:12:02,310
whose motive is financial gain.

283
00:12:02,310 --> 00:12:04,083
This is a really scary group.

284
00:12:05,100 --> 00:12:07,680
One, two, three.

285
00:12:07,680 --> 00:12:10,353
And that's our cyber
criminals or organized crime.

286
00:12:11,640 --> 00:12:13,620
And number five.

287
00:12:13,620 --> 00:12:16,230
The time, effort, and resources required

288
00:12:16,230 --> 00:12:17,370
to accomplish a task.

289
00:12:17,370 --> 00:12:19,410
What's the term we use to describe

290
00:12:19,410 --> 00:12:22,350
the time, effort and resources required

291
00:12:22,350 --> 00:12:24,270
to accomplish a task?

292
00:12:24,270 --> 00:12:25,773
One, two, three.

293
00:12:27,011 --> 00:12:28,811
And that's gonna be our work factor.

294
00:12:31,456 --> 00:12:32,653
All right, let's do a security in action

295
00:12:32,653 --> 00:12:34,950
and practically apply our knowledge.

296
00:12:34,950 --> 00:12:37,470
This one's about insider activity.

297
00:12:37,470 --> 00:12:39,690
You notice that one of
your coworkers work habits

298
00:12:39,690 --> 00:12:41,940
have changed dramatically.

299
00:12:41,940 --> 00:12:45,840
He's coming in earlier than
usual, and he's staying later.

300
00:12:45,840 --> 00:12:49,860
He's intently focused, he's
asking unusual questions

301
00:12:49,860 --> 00:12:52,110
and he becomes unusually defensive

302
00:12:52,110 --> 00:12:54,180
when questioned about his work.

303
00:12:54,180 --> 00:12:56,010
Very uncharacteristically,

304
00:12:56,010 --> 00:12:58,770
he canceled his long-planned vacation.

305
00:12:58,770 --> 00:13:01,020
Now, your supervisor doesn't
seem at all concerned

306
00:13:01,020 --> 00:13:02,520
and to the contrary,

307
00:13:02,520 --> 00:13:05,793
has been praising your
coworker's initiative and output.

308
00:13:07,200 --> 00:13:09,060
Is your concern warranted?

309
00:13:09,060 --> 00:13:12,120
And if so, what should you do?

310
00:13:12,120 --> 00:13:13,830
So you notice that something's going on

311
00:13:13,830 --> 00:13:16,260
and you're just you don't
feel right about it, right?

312
00:13:16,260 --> 00:13:19,320
And with all these things
happening, the question is,

313
00:13:19,320 --> 00:13:21,030
is there something to
be concerned about here?

314
00:13:21,030 --> 00:13:23,220
Is your concern warranted?

315
00:13:23,220 --> 00:13:25,440
And if so, what are you gonna do?

316
00:13:25,440 --> 00:13:26,610
Go ahead, put me on pause.

317
00:13:26,610 --> 00:13:28,800
Think about this for a minute,
jot down your response,

318
00:13:28,800 --> 00:13:30,800
then come back and we'll do it together.

319
00:13:32,880 --> 00:13:36,510
Well, absolutely, yes,
your concern is warranted.

320
00:13:36,510 --> 00:13:39,000
Cybersecurity measures
are frequently focused

321
00:13:39,000 --> 00:13:41,550
on threats outside the organization

322
00:13:41,550 --> 00:13:44,130
rather than threats
inside the organization.

323
00:13:44,130 --> 00:13:45,240
We hate to think about the fact

324
00:13:45,240 --> 00:13:47,100
that we might have untrusted worthy people

325
00:13:47,100 --> 00:13:50,040
inside our organization, but the truth

326
00:13:50,040 --> 00:13:53,220
is that insiders have
caused irreparable harm

327
00:13:53,220 --> 00:13:58,220
to organizations as well as to
national security interests.

328
00:13:58,260 --> 00:14:00,300
So you should document your concerns

329
00:14:00,300 --> 00:14:03,780
and report your concerns
to the HR department.

330
00:14:03,780 --> 00:14:05,880
Obviously, your supervisor's okay with it.

331
00:14:05,880 --> 00:14:08,700
So go to the HR
department, document first,

332
00:14:08,700 --> 00:14:10,770
if these are the things
you're concerned about,

333
00:14:10,770 --> 00:14:13,320
the HR department will
keep this confidential

334
00:14:13,320 --> 00:14:16,563
and then report those
concerns to the HR department.

335
00:14:17,520 --> 00:14:18,707
Now, if that's not an option,

336
00:14:18,707 --> 00:14:21,360
perhaps you don't have an HR department

337
00:14:21,360 --> 00:14:23,430
then you should discuss your concerns

338
00:14:23,430 --> 00:14:25,593
with a member of senior management.

339
00:14:27,060 --> 00:14:28,920
And in either case, when you go to them,

340
00:14:28,920 --> 00:14:31,410
they might be really dismissive at first.

341
00:14:31,410 --> 00:14:34,530
And so your job is going to educate them

342
00:14:34,530 --> 00:14:37,260
on threat actors specifically,

343
00:14:37,260 --> 00:14:40,110
or especially in this
case, insider threats.

344
00:14:40,110 --> 00:14:42,210
And being able to have
those conversations,

345
00:14:42,210 --> 00:14:44,403
that my friends, is security in action.

346
00:14:46,800 --> 00:14:48,270
That brings you to your word cloud.

347
00:14:48,270 --> 00:14:49,590
You know what to do, right?

348
00:14:49,590 --> 00:14:51,450
Make sure you can go
through all of these terms.

349
00:14:51,450 --> 00:14:53,850
You can explain them, you understand them,

350
00:14:53,850 --> 00:14:56,160
you can teach somebody
else what they mean.

351
00:14:56,160 --> 00:14:56,993
When you're ready,

352
00:14:56,993 --> 00:14:58,710
head on over to the next lesson, 5-2

353
00:14:58,710 --> 00:15:00,593
and I'll be waiting for you right there.