A Field Guide to Insider Threat Helps Manage the Risk · SESSION ID: #RSAC Tim Casey A Field Guide...

SESSION ID:SESSION ID:

Tim Casey

A Field Guide to Insider Threat Helps Manage the Risk

HUM-T10R

Senior Strategic Risk AnalystIntel Corp.

How do you think of insider threat?

The problem is becoming more complex

3Logos and trademarks are the property of their respective owners

The Field Guide to Insider Threat

Accidental leak

Espionage

Financial fraud

Misuse

Oportun. data theft

Physical theft

Product alteration

Sabotage

Violence

Reckless

Insider

Untrained/

Distracted

Insider

Outward

SympathizerVendor Partner

Irrational

IndividualThief

Disgruntled

InsiderActivist Terrorist

Organized

CrimeCompetitor

Nation

Characterizing Insider Threat

Definitions

Insider Threat is the potential for a current or former employee, contractor, or business partner to accidentally or maliciously misuse their trusted access to harm the organization’s employees and customers, assets, or reputation.

A Threat Agent is a representative classof people who can harm an organization, intentionally or accidentally, and identified by their unique characteristics and behaviors.

Insider Threat Agents

Non-Hostile

Reckless Insider

Outward Sympathizer

Untrained/ Distracted Insider

Hostile/Non-Hostile

Partner

Supplier

Hostile

Activist

Competitor

Disgruntled Insider

Irrational Individual

Nation State

Organized Crime

Terrorist

Non-Hostile Non-Hostile OR Hostile Hostile

Attack Types

Accidental leak

Espionage

Financial fraud

Misuse

Opportunistic data theft

Physical theft

Product alteration

Sabotage

Violence

Attack Types

IP & Data Loss

Ongoing, targeted IP extraction

Exiting employees

Accidental leak

Espionage

Financial fraud

Misuse

Opportunistic data theft

Physical theft

Product alteration

Sabotage

Violence

Threat-Consequence Vector Matrix

Analysis by Intel’s Threat Agent Analysis Group

Intent Non-HostileNon-Hostile

/HostileHostile

Attack Type

Reckless

Insider

Untrained/

Distracted

Insider

Outward

Irrational

IndividualThief

Disgruntled

Organized

CrimeCompetitor

Nation

Accidental leak X X X X X X X

Espionage X X X X X X X X

Financial fraud X X X X X

Misuse X X X X X X X XOpportunistic data

theftX X X X X X X X

Physical theft X X X X X X

Product alteration X X X X X X X X X

Sabotage X X X X X X

Violence X X X

Applying the Field Guide

Demonstrate the scope of the problem

/HostileHostile

Attack Type

Reckless

Employee

Untrained/

Distracted

Insider

Outward

Irrational

IndividualThief

Disgruntled

Organized

CrimeCompetitor

Nation

Accidental leak X X X X X X XEspionage X X X X X X X X

Financial fraud X X X X XMisuse X X X X X X X X

Opport. data theft X X X X X X X XPhysical theft X X X X X X

Product alteration X X X X X X X X XSabotage X X X X X XViolence X X X

60 separate Insider Threat vectors –Are you prepared for all of them?

Prioritizing Protection to Optimize Resources

• Accidental leak

• Espionage

• Financial fraud

• Misuse

• Opport. data theft

• Physical theft

• Product alteration

• Sabotage

• Violence

/HostileHostile

Attack Type

Reckless

Insider

Untraind

Distractd

Insider

Outward

Sympathiz

Vendor PartnerIrrational

IndividualThief

Disgruntled

Organized

CrimeCompetitor

Nation

Misuse X X X X X X X X

Opportunistic data

Violence X X X

Food Manufacturer (example)

Prioritizing Protection to Optimize Resources

/HostileHostile

Attack Type

Reckless

Insider

Untraind

Distractd

Insider

Outward

Sympathiz

Vendor PartnerIrrational

IndividualThief

Disgruntled

Organized

CrimeCompetitor

Nation

Opportunistic data

Violence X X X

Food Manufacturer (example)• Accidental leak

• Espionage

• Financial fraud

• Misuse

• Opport. data theft

• Physical theft

• Violence

• Product alteration

• Sabotage

/HostileHostile

Attack Type

Reckless

Insider

Untrained/

Distracted

Insider

Outward

Irrational

IndividualThief

Disgruntled

Organized

CrimeCompetitor

Nation

Opportunistic data

Violence X X X

Minimize the Threat

/HostileHostile

Attack Type

Reckless

Insider

Untrained/

Distracted

Insider

Outward

Irrational

IndividualThief

Disgruntled

Organized

CrimeCompetitor

Nation

Opportun. data theft X X X X X X X X

Violence X X X

Provide context for your data

2-day factory downtime

Lost market lead in key product

$15M in lawsuits

3% annual shrinkage

Example incidents

Customize for your threat landscape

The model is open-ended and you can extend & tailor it to your environment

How the Guide Can Help You

Having a Field Guide helps you manage risk by:

Establishing a common framework and language for managing insider threat throughout the organization and community

Prioritizing threats and optimizing the use of limited resources

Identifying threats for mitigation

A framework to describe and manage your unique threat landscape

Applying the Field Guide in Your Organization

Short termShare the Guide with key stakeholders to inform them of the problem scope and enlist them in your team

Assess your particular threats and controls against the Field Guide to ensure you are managing your most dangerous insider risks

Medium termModify the model to reflect your situation and priorities

Long termUse the Guide to regularly re-assess your overall insider threat landscape

Resources

Intel Field Guide to Insider Threat: http://ow.ly/CLux308vUbP

Intel Threat Agent Analysis: https://communities.intel.com/docs/DOC-23914https://communities.intel.com/docs/DOC-1151

Improving Healthcare Risk Assessments to Maximize Security Budgets (how to tailor the model for your environment):http://ow.ly/1W2H308vUfx

CERT Insider Threat Center: https://www.cert.org/insider-threat

We actively engage with fellow travelers utilizing Threat Agent Analysis related to:

Threat Assessments

Supplier Management and Supply Chain Risk

Tools and Visualization

Questions?

A Field Guide to Insider Threat Helps Manage the Risk · SESSION ID: #RSAC Tim Casey A Field Guide...

Documents

Insider Threat Experiences

Managing insider threat - EY - United StatesFIL… · Managing insider threat risk should be part of a holistic corporate security program, from both information security and physical

Insider Threat Potential Risk Indicators (PRI)

Potential Risk Indicators: Insider Threat What is the ... › documents › toolkits-insider › ... · Potential Risk Indicators . Most insider threats exhibit risky behavior prior

Management and Education of the Risk of Insider Threat ...Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System Sabotage Dawn

Evolving Insider Threat Detection

INSIDER THREAT - Optiv · Insider Threat Defined While insider threat has been defined in many different ways, Optiv defines insider threat as: “An insider threat is an employee,

Insider Threat in IT

Insider Threats - University of Pittsburgh · Unintentional Insider Threat Definition • An unintentional insider threat is (1) a currentAn unintentional insider threat is (1) a

TR Insider Risk Evaluation · Previous insider threat research by Shaw and Fischer identified individual, situational and contextual factors associated with insider offenses. Building

An integrated approach to insider threat mitigation …...Security Technical White Paper March 2017 An integrated approach to insider threat mitigation and risk management Detect,

Insider Threat Mitigation

2018 Insider Threat Report - Crowd Research Partnerscrowdresearchpartners.com/.../2017/07/Insider-Threat-Report-2018.pdf · The resulting Insider Threat Report is the most comprehensive

CYBERSECURITY - SIFMA€¦ · the insider threat at financial institutions; and (3) to help financial firms measure their insider threat program’s effectiveness. The Insider Threat

Keeping Up with the Joneses: How Does Your Insider Threat ...How Does Your Insider Threat Program Stack Up? HUM-W02 . Dawn M. Cappelli . Director, Insider Risk Management . Rockwell

Managing insider threat

A Risk Management Approach to the “Insider Threat”

INSIDER THREAT DEFENSE Threat Defense-Insider... · INSIDER THREAT DEFENSE Security Behind The Firewall Is Our Business Table of Contents Page The Insider Threat - How Vulnerable

The Insider Threat

Insider threat v3