1. Insider Threats Stephen Helms Jen Hugg Matt McNealy

2. “The Insider”  A trusted member of the organization  60% to 70% of attacks came from the insider   roughly twice the number of attacks come from the inside vs. the outside

3. Examples  Acxiom Corp  ChoicePoint  Wachovia Corp. and Bank of America  City of San Francisco

4. Insider Threat Study  Secret Service National Threat Assessment Center (NTAC)  Carnegie Mellon University Computer Emergency Response Team (CERT)  Nature of Insider Attacks  Usual Suspects  Motivations

5. ITS Findings  Former employees who held technical positions  Motivated by revenge  Unsophisticated methods  Attacks occurred outside of normal working hours  Remote Access

6. ITS Recommendations  Restrict remote access  Restrict system administrator access  Collect information for all remote logins  Monitor failed remote logins

7. Role of the Auditor   Educated and Aware Employees   Password sharing   Entrance Barriers   Sensitive information   Employee Attitude

8. Securing Against Insider Attacks  Software  Testing  Attack Simulations  Training