How To Get Started IMPACT 2015 Phil Robinson 2 Video removed due - PowerPoint PPT Presentation

Insider Threat Programs: How To Get Started IMPACT 2015 Phil Robinson

2 Video removed due to size constraints

3 Theme — Insider Threat is NOT ONLY about protecting data on your network… — Risk: Tolerance/Avoidance/Acceptance — Company culture and willingness to adjust — Understand your business environment — Needs vs. wants vs. dollars — Advancement of your program – total assets protection

4 NISPOM CC#2 what we know today (27 April 2015) — When issued NISPOM Conforming Change 2 will require cleared industry to implement insider threat program — Industry has six-months to implement upon issuance of the NISPOM Conforming Change 2 — The NISPOM will outline minimum standards that include; — Establish and maintain an insider threat program — Designate insider threat senior official — Gather, integrate, and report — Conduct self-assessments of insider threat program — Insider threat training — Monitoring network activity — User acknowledgements — Classified Banners Source: DSS

5 Before you go Down that Road — Ask yourself a host of questions: — Why have an Insider Threat Program? — What does Insider Threat mean to your company? — What’s the stated goal? — What are the objectives? — Are you prepared to drive the message? — Do you have needed resources? — Do you have an SME on your team? — Do you have a network to bounce ideas off?

6 Before you go Down that Road — Do you have support? — Senior Leadership — Potential Stakeholders — Business — What’s your company’s tolerance / culture? — Size — Scope — Acceptance — “Insider Threat” the right phraseology

7 Before you go Down that Road — Assess your data – determine what needs to be protected under this umbrella — Perform a risk analysis of your data — Understand what you are protecting Bottom line: what do you really need? Compliancy only OR Value add

8 General Overview What is Insider Threat? — Definition CERT: A malicious insider threat to an organization is a current or former employee, contractor, or other business partner who has or had authorized access to an organization's network, system, or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization's information or information systems. [focus: data loss prevention] Source: CERT

9 General Overview What is Insider Threat? — Definition DoD: Acts of commission or omission by an insider who intentionally or unintentionally compromises or potentially compromises DoD’s ability to accomplish its mission. These acts include, but are not limited to, espionage, unauthorized disclosure of information, and any other activity resulting in the loss or degradation of departmental resources or capabilities. [focus: protection of national security information] Source: DSS

10 General Overview What is Insider Threat? Industry - For Consideration: An Insider Threat is a current or former employee, contractor, or other business partner who exceeds or misuses, intentionally or unintentionally, access in a manner that violently or non- violently negatively impacts COMPANY’S assets; computer systems, networks, people, information, processes, reputation, facilities, equipment, operations, etc. This includes any person with authorized access to United States Government resources; personnel, facilities, information, equipment, networks, or systems while a representative of the company. [focus: protection of the company; extended to clients]

11 Existing Programs Robust Less Robust — Ad-hoc group called together — Formal Insider Threat Team with to handle events and assigned analysts and SMEs incidents or incident handled by response processes and — Defined insider threat response personnel plan — Use existing incident — Integrated information sharing and response plan or no response data collection including technical plan and behavioral indicators — User monitoring via host and — Focused across current and former network based analysis only employees, contractors, subcontractors, supply chain, and — Focused on current and other trusted business partners former employees Source: CERT

12 Existing Programs Less Robust Robust Your Company Economical GOLD plated — Ad-hoc group called together — Formal Insider Threat Team with assigned analysts and SMEs to handle events and incidents or incident handled — Defined insider threat response by response processes and plan personnel — Integrated information sharing — Use existing incident and data collection including response plan or no response technical and behavioral plan indicators — User monitoring via host and — Focused across current and network based analysis only former employees, contractors, subcontractors, supply chain, and other trusted business — Focused on current and partners former employees Source: CERT


 
 
 
 
 
 
 
 
 13 A-typical Multifaceted Insider Threat Program Model 3 Source: ASIS D&C ITWG

14 Design Steps • High-level Example company-wide policies are approved and published • Determine technologies for • ITP is formally monitoring and launched and is analytics operational • Policies and • Formulate • Monitoring and procedures are incident Audit written to response procedures support the requirements initiated development • Audit and • Mitigation • Risk Security and operation of improvement procedures Risk all ITP elements requirements operational Management incorporated • Incorporate I (ESRM) counterintelligen • Completed ITP • Form IT Working processes M ce controls and Group (ITWG) plan is reviewed initiated to measures and approved as identify assets, P • Define critical • Security appropriate threats and positions and education plan L vulnerabilities • Select ITP model modify position • Develop modified to and components descriptions collaboration E • Integrate ESRM incorporate ITP based on plan for external and ITP metrics • Build consensus requirements relationships M criticality into an and advocacy analytical • Identify and among core • Corporate wide • Pilot ITP E review historical stakeholders structure ITP metrics/ N insider threat (Convergence) measures • Identify incidents developed requirements • In concert with T • Need & purpose General Council for core • Metrics elements: A for ITP and HR develop dashboard articulated corporate ITP Operations, designed T Analytics, policy • Obtain senior • Design Collaboration, I executive buy-in • Develop comprehensive and Education for program comprehensive education plan O charter plan and INITIATION timelines N FORMULATION EVALUATION Source: ASIS D&C ITWG

15 Program Road Map Example Source: INSA

16 A-typical Insider Threat Organizational Stakeholder Model HR Exec Security Sponsor Insider Threat Program Business Legal IT/SOC

17 The journey

18 Theme (principle tenants) — Insider Threat is NOT ONLY about protecting data on your network… — Risk: Tolerance/Avoidance/Acceptance — Company culture and willingness to adjust — Needs vs. wants vs. dollars

19 Know Your Company — Understand your company’s dynamics — Cultural acceptance of a program Naming convention sensitivities [Insider Threat] — Who/what org leads investigative activities today? — — Is security / risk a focus area supported by management? — What could be managements expectations? — Do you have the clout to “carry the message”? — How does a program benefit your company? — Identify, understand, and outline the need — Contractual & Regulatory Compliancy's NISPOM Conforming Change #2 (TBA – EOM July 15 >) — DFAR — FAR — DD254 — Contractual Source Documentation —

20 Know Your Company — Know if you have Proprietary Information — Where your government information is housed — Classified — Sensitive — Technology — Do elements of a program already exist? — Fraud — Counterintelligence (NISP) — Physical Security — Information Systems Security — Ethics hot line — Etc… — Leverage client driven requirements

21 The Art of the Deal its all in how you communicate — Frame the conversation to your benefit — Guide opinions and direct your team — Acceptance and tolerance of others’ opinions — Guard against your AAA Security Practitioner stubbornness (my way or hi-way attitude) — Learn how to compromise — Does the end state concur with your goal?

22 Make a Convincing Case — Build a Communication Plan — Design your message so that it carries on its merits — Level set message to particular audiences / individuals — Know what you communicate — Who you communicate with — Understand their tolerance for the discussion — Work the halls of the company — Start to message your intentions with stakeholder departments — Insert verbiage in your traditional security awareness materials