Detecting Insider Threats: Actions Speak Louder than Words Nick Cavalancia Technical Evangelist Techvangelism #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM NICK CAVALANCIA Technical Evangelist Certifications: MVP / MCSE / MCT / MCNE / MCNI Co-Founder of ConversationalGeek.com Founder of Techvangelism Consultant/Trainer/Speaker/Author Technical author with over a dozen books Technical speaker for Techmentor, Connections, SpiceWorld Regular speaker for 1105 Media, Penton, Spiceworks, TechTarget Writes, Speaks, and Blogs for some of today’s best-known tech companies #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM SESSION AGENDA Look at the state of insider threats Where to place your focus How to spot an insider What it takes to build an Insider Threat Program #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM THE ELUSIVE INSIDER 28% Data breaches committed by an insider 56% Regular Employees 55% Privileged Users IT Admins 42% Contractors Service Providers Temp. Workers 59% Emp. take data when they leave ******* 6 Passwords Shared by the avg. user vz.to/2JzzhGq bit.ly/2pKqJXy bit.ly/LPStateOfThePswd bit.ly/DelDbrief Delloite Debrief March 2016 #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

CASE STUDY: HEALTHCARE vz.to/2zZjkXy 58% Incidents involved insiders 48% Financially motivated Error Misdelivery ! Misuse Priv. Abuse Physical Theft Hacking Stolen Creds. Malware Ransomware Social Phishing #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

Remember: External threat actors eventually look like an insider too! #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

WHY IS SPOTTING AN INSIDER SO TOUGH? Simple answer: They’re on the inside. Not that simple, though: Can exist anywhere in the organization Insider risk shifts Looks like they’re doing their job Lots of insider actions Lots of valuable data Need to define what’s an insider to you #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

Where should you place your focus? Where your risk is. #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

DETERMINING INSIDER RISK STEP 1: INVOLVE THE RIGHT PEOPLE Insider Threat Program Team Need perspective of several positions Executive Leadership Human Resources Legal IT LoB Owners, Department Heads Security #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

DETERMINING INSIDER RISK STEP 2: DEFINE RISK LEVELS Assign risk based on: Position/Role Department Individual #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

DETERMINING INSIDER RISK STEP 3: ALIGN RISK LEVELS WITH SECURITY CONTROLS User Behavior Analytics Security Awareness Training User Activity Monitoring Data Loss Prevention Secure Admin Workstation Priv. Access Management #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM Spotting the Insider #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

IT’S ALL ABOUT BEHAVIOR Leading Indicators Shift in behavior Shifts in communication Active Indicators Unusual Inappropriate Consider not all threats are malicious Shifts in behavior - 92% of insider threat cases were preceded by a negative workplace event #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM THREAT INDICATORS Leading Active Personal Changes HR issues Arrival/Leaving times Positive to negative tone “We/Us” to “I/Me” Looking for a new job Communications Unusual logon times Abnormal application use Excessive Printing Access of sensitive data Copying of sensitive data Communications Shifts in behavior - 92% of insider threat cases were preceded by a negative workplace event #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM IT’S ALL ABOUT CONTEXT One action doesn’t indicate a threat Culmination of actions, tone, communications, etc. Need to have complete visibility into employee activity Online Offiline #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

Building an Insider Threat Program #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

INSIDER THREAT PROGRAM MATURITY MODEL Shifts in behavior - 92% of insider threat cases were preceded by a negative workplace event #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

INSIDER THREAT PROGRAM MATURITY MODEL Shifts in behavior - 92% of insider threat cases were preceded by a negative workplace event #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

BUILDING AN INSIDER THREAT PROGRAM STEP 1: UNDERSTAND YOUR OBSTACLES Support Budget Culture Stakeholders Employees Communications Privacy Only 27% had full support of the C-Suite Largest was Some Support @ 37% Biggest blocker was Finance HR most concerned about Privacy Communications – Only 21% of orgs had formalized communications #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

BUILDING AN INSIDER THREAT PROGRAM STEP 2: CREATE THE ITP TEAM Did this at Risk Assessment… Key Stakeholders Executive Leadership Human Resources Legal IT LoB Owners, Department Heads Security Designate an ITP Senior Official 75% of orgs have no formalized ITP #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

BUILDING AN INSIDER THREAT PROGRAM STEP 3: ASSEMBLE CRITICAL DOCUMENTATION & NOTICES Background/Credit Checks Confidentiality and Intellectual Property Agreement (CIPA) Acceptable Use Policy Security Acknowledgement Agreement Logon Banners #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

BUILDING AN INSIDER THREAT PROGRAM STEP 4: SELECT INTELLIGENCE SOURCES Human Resources Physical Security User Behavior Analytics User Activity Monitoring Auditing Data Goal is to be as close to the intersection of the user and everything they interact with as is possible – apply it to HR and all other data sources. #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

BUILDING AN INSIDER THREAT PROGRAM STEP 5: BUILD INCIDENT RESPONSE PLANS Scenario-Based Leading Indicators Active Indicators Employee Giving Notice Employee Being Terminated Goal is to be as close to the intersection of the user and everything they interact with as is possible – apply it to HR and all other data sources. #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

BUILDING AN INSIDER THREAT PROGRAM STEP 5: BUILD INCIDENT RESPONSE PLANS #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

BUILDING AN INSIDER THREAT PROGRAM STEP 5: BUILD INCIDENT RESPONSE PLANS Scenario-Based Leading Indicators Active Indicators Employee Giving Notice Employee Being Terminated Not a comprehensive list. #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

GETTING A HANDLE ON INSIDER THREATS Understand it’s real and risky Define insider threat Classify your organizational risk Determine threat behaviors Build the ITP Processes, Policy, Technology, Response Not a comprehensive list. #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM QUESTIONS? #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM

#ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM THANK YOU nick.cavalancia@techvangelism.com Don’t forget to visit conversationalgeek.com #ITDEVCONNECTIONS | ITDEVCONNECTIONS.COM