A Seven Step Process to Combat Insider Threats

Incident response testing is the stone that kills many birds…

Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .

Good morning.  It’s 5:00am on a weekend, and I’m preparing my talk for the Cybersecurity Conference this week. While the talk is only supposed to be about trends and not solutions, I just have to bullet point out what I would do if I was an ISO of a bank who had just watched my talk.  So here’s another “Seven List from Dan.”

Seven Step Process to Combat Insider Threats

1. Security Culture:  Is the board on board?  Does your culture already encourage “self-reporting” (no awkwardness surrounding the statement), “I think I just clicked on a link.”  With this kind of culture, users are more apt to respond when there is a threat to the culture, such as an insider threat.
2. Conduct a threat analysis to determine where the insider threat falls in comparison to other threats.  While likelihood is perceived to be low (and is probably ranked lower than reality), the result is usually surprising due to elevated impact. Try redoing this threat analysis with the prerequisite statement of “during a merger” or “during a large layoff.”
3. Make sure physical and fraud are on the Incident Response Team.
4. Develop an Insider Threat Response Scenario as a part of your overall incident response plan.  Make sure that any changes in response structure, due to legal risks and other issues surrounding arresting a co-worker, are already built into the incident response processes.  (And tested).
5. Be sure to learn how your SIEM looks for insider threats.  Facilitate that.
6. Elevate to your SOC/MSSP when “conditions” increase the likelihood of the insider threat (mergers, layoffs, malicious terminations, etc).
7. Test your Insider Threat Incident Response Scenario.  Address action items in the post-mortem review.  Add the continuous improvement of this process, commensurate to the risk identified in your threat analysis, to your overall IT Governance Program cycle. If you only get to one of these seven steps, it should be this one!

I’m sure there’s a lot of other things we can do when it comes to insider threats, but this should hopefully get the conversation started in your next steering committee meeting!

Original article by Dan Hadaway CRISC CISA CISM. Founder and Managing Partner, infotex

“Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”