About Us | Contact Us
View Cart

A Seven Step Process to Combat Insider Threats

By Dan Hadaway | Monday, September 30, 2019 - Leave a Comment

Incident response testing is the stone that kills many birds…


Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


ServIcons_ITAudit_01

Good morning.  It’s 5:00am on a weekend, and I’m preparing my talk for the Cybersecurity Conference this week. While the talk is only supposed to be about trends and not solutions, I just have to bullet point out what I would do if I was an ISO of a bank who had just watched my talk.  So here’s another “Seven List from Dan.”

Seven Step Process to Combat Insider Threats

  1. Security Culture:  Is the board on board?  Does your culture already encourage “self-reporting” (no awkwardness surrounding the statement), “I think I just clicked on a link.”  With this kind of culture, users are more apt to respond when there is a threat to the culture, such as an insider threat.
  2. Conduct a threat analysis to determine where the insider threat falls in comparison to other threats.  While likelihood is perceived to be low (and is probably ranked lower than reality), the result is usually surprising due to elevated impact. Try redoing this threat analysis with the prerequisite statement of “during a merger” or “during a large layoff.”
  3. Make sure physical and fraud are on the Incident Response Team.
  4. Develop an Insider Threat Response Scenario as a part of your overall incident response plan.  Make sure that any changes in response structure, due to legal risks and other issues surrounding arresting a co-worker, are already built into the incident response processes.  (And tested).
  5. Be sure to learn how your SIEM looks for insider threats.  Facilitate that.
  6. Elevate to your SOC/MSSP when “conditions” increase the likelihood of the insider threat (mergers, layoffs, malicious terminations, etc).
  7. Test your Insider Threat Incident Response Scenario.  Address action items in the post-mortem review.  Add the continuous improvement of this process, commensurate to the risk identified in your threat analysis, to your overall IT Governance Program cycle. If you only get to one of these seven steps, it should be this one!

I’m sure there’s a lot of other things we can do when it comes to insider threats, but this should hopefully get the conversation started in your next steering committee meeting!

 


Original article by Dan Hadaway CRISC CISA CISM. Founder and Managing Partner, infotex

“Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”


same_strip_012513


 

Latest News
    What are the top seven risks your board should know about in 2021? Since his first board presentation in 2000, when Dan presents audit reports to boards of directors, he also talks to the board about the top risks the institution is facing. Since 2006, Dan has been compiling a list of the “top seven […]
     A Timeline Update as of 02/22/21 An update to our Newest Employee’s FIRST Technical Article Another interim post-mortem review . . . . A Note About Updates: We have decided to leave the original article as it was originally posted and to update this post with any changes that have been made. You can see […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    A Webinar-Movie The 2020 annual webinar update on the subject will include a review of the previous years’ movies that are already available, and a discussion about alternative tactics that have arisen from recent virtual conferences and regulator panels.
    The cybersecurity industry faces challenges, and some of them may involve your business… An article review. In a world where threats to your organization’s electronic assets are constantly emerging and evolving a cybersecurity insurance policy can help mitigate risk…but what kind of risk does the cybersecurity insurance industry face?  A new article in the Harvard […]
    A Timeline as of 01/24/2021 Our Newest Employee’s FIRST Technical Article Another interim post-mortem review . . . . A Note About Updates: We are leaving this article as is, but for any updates to the timeline, check the Autopsy of the SolarWinds Hack Timeline Update article!      – Vigilize Introduction: As the managing […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS FORUM AND CONFERENCE NEWS infotex is proud to announce that Dan Hadaway will be moderating a series of IT Forums for the Ohio Bankers League. “We are excited to continue fostering the relationship with the OBL to help educate and keep Risk Management at the forefront of […]
    Top 7 Trend Articles of 2021. . .  . . .For ISOs of Small Financial Institutions. Welcome to our annual T7 article:  a list of our favorite trend articles from the past year.  Our intent: help you organize your thoughts as your work through your strategic planning process.  We hope reviewing these articles will help you […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    A Webinar-Movie In our current world of uncertainty there is at least one thing that is certain. Business needs to continue, and that means that it is important for managers to be able to meet with their team even if everyone is working remotely at this point. In this Webinar-Movie, Dan will compare virtual meeting […]