Chapter 1. Overview Insiders pose a substantial threat due to their knowledge of and access to their employers’ systems and/or information. They bypass physical and electronic security measures through legitimate means every day. There is no demographic profile of a malicious insider—they are men and women, married and single, young and old, and cover a range of ethnicities. However, we have identified some distinct characteristics of insiders and their crimes, which can be used in designing mitigation strategies. Insider IT sabotage is typically committed by technical users with privileged access, such as system administrators, database administrators, and programmers. The motivation in these crimes is usually revenge for a negative workplace event, and the crimes are often set up while still employed, but executed following termination. Insider theft of intellectual property (IP) is usually committed by scientists, engineers, programmers, and salespeople. These insiders usually steal the information they worked on, and take it with them as they leave the organization to start their own business, take with them to a new job, or give to a foreign government or organization. Insider fraud is usually committed by lower-level employees such as help desk, customer service, and data entry clerks. The crimes are motivated by financial need or greed, and they typically continue for a long period of time. Many of these insiders are recruited by outsiders to steal information. Collusion with other insiders is very common in crimes involving modification of information for payment from the outside. In this chapter, we begin with true stories of insider attacks, which will help you to understand the different types of insider crimes as well as the potential consequences. We believe that the more actual cases you read, the more you will come to understand the patterns in the cases. Next, we point out the expanding complexity of insider threats. Although we have broken the problem into three distinct crime profiles, and most incidents resemble those profiles, there are some complex issues that we must point out so you understand the scope of the problem. In this chapter we simply want to raise the issues so that you keep them in mind as you read the rest of the book. In Chapter 9, Conclusion and Miscellaneous Issues, we provide more detail on each of these issues. The next section contains a breakdown of the cases in our insider threat database. Our database of more than 700 insider threat cases provides an unmatched wealth of information that can be useful to all of you in understanding insider threats and in designing mitigation strategies. If you are interested in additional details from our database, refer to Appendix B, Deeper Dive into the Data. In addition, Appendix C, CyberSecurity Watch Survey, contains detailed findings from the CyberSecurity Watch Survey, which we conduct annually with the Secret Service and CSO Magazine.1 Next, we explain the importance of our crime profiles and associated crime models. Over the years, we have heard that the first impression of some practitioners is that they are not interested in “academic models.” The good news is that, although in some cases we started with complex academic models, we have translated them into straightforward, practical teaching tools that have raised awareness and resulted in successful mitigation strategies for practitioners for years. Those high-level models are the ones we use in this book. We end this chapter with a brief description of the objective and work of the CERT Insider Threat Center. If you don’t care where material in this book Chapter 2. Insider IT Sabotage Insider IT sabotage: insider incidents in which the insider uses information technology (IT) to direct specific harm at an organization or an individual. Cases of insider IT sabotage include the most technically sophisticated attacks in the CERT insider threat database, and have caused substantial harm to people and organizations. Insider IT sabotage has occurred in almost every critical infrastructure sector, and poses a threat to virtually every organization in government and industry—to any organization reliant on information technology. In one insider IT sabotage case, a former system administrator wiped out 18 months of cancer research, which was never recovered. In another, a company lost $10 million, laid off 80 employees, and nearly went out of business. In yet another, billions of critical files were deleted from a financial institution’s servers around the world when a logic bomb went off on every server at 9:00 a.m. just when the banks opened for business. In this chapter we describe the profile of insider IT sabotage and present strategies for mitigating insider IT sabotage crimes.1 These crimes are committed by technically sophisticated system administrators or programmers, using the same types of online actions typically used by those same employees or contractors in the course of their normal activity. Therefore, some say that stopping these types of attacks is next to impossible. Fortunately, we have identified distinct patterns in nearly every insider IT sabotage case. In this chapter we describe those patterns and present mitigation strategies that use those patterns to your advantage. These techniques include both technical and nontechnical measures. In addition, some are proactive across the enterprise, while others are targeted at specific employees triggered by indicators that could suggest an increased risk of attack. Fortunately, we have identified distinct patterns in nearly every insider IT sabotage case. In this chapter we describe those patterns and present mitigation strategies that use those patterns to your advantage. For example, we suggest countermeasures such as periodic account audits, since a number of these insiders created backdoor accounts2 prior to being fired so that they could get back in and exact their revenge following termination. With more and more identity management systems3 available, we would expect to see a reduction in the use of this technique. However, during the week this chapter was written, a former system administrator at a large, multinational corporation used a VPN token4 he had created for a nonexistent employee prior to being fired to break back into his employer’s network and sabotage its systems. On the other hand, we realize that account audits are time consuming and difficult to perform, especially at times of reduced staffing levels. Therefore, we also suggest that when a system administrator is sanctioned and “on the HR radar” you perform a detailed audit of all accounts that have been created since he first became disgruntled and began exhibiting concerning behaviors in the workplace. The bottom line is that we believe there is a good chance to thwart these attacks, but it requires careful planning and implementation of mitigation strategies across your organization. We do have some “good-news” cases. • A logic bomb would have wiped out every file on every server on the network. Fortunately, the organization reacted swiftly to a suspicious comment made by a system administrator who was to be fired the following Monday, took all systems offline over the weekend, and discovered the logic bomb before it executed. • A logic bomb would have destroyed information on more than 70 servers, including
Purchase answer to see full attachment