Phil Venables

First of all, this short thread isn’t going to even come close to covering all aspects of well managed insider threat programs - instead there is excellent coverage by SIFMA (https://bit.ly/2OBPYWu ) and CERT (https://bit.ly/361PS0j ). 2/16

Grossly simplifying, there are 3 types of threats : trusted insiders who go bad over time due to disgruntlement or other (Progressive Insider Risks), trusted insiders who go bad immediately from some cue like coercion from an external actor (Instantaneous Insider Risk), 3/16

and there are infiltrators, i.e. external attackers who infiltrate the organization. Infiltrators can often look like Instantaneous Insider Risks, so we’ll just discuss the first 2 types. 4/16

Note: one of the benefits of effective insider threat risk mgmt is you can protect from error/carelessness often with the same precautionary steps as you would to thwart malicious intent - this can often be worth doing even if you're not considered a significant target. 5/16

1. Progressive Insider Risks As the name implies, these people go bad over time before perpetrating usually small then progressively large malicious actions. They can get caught by detecting some “disturbance in the force” (h/t @taylopet for this phrase in this context). 6/16

Such detections can be from their activities (e.g. accessing more information, leaking data, small infractions, job performance issues, etc.) or changes in their behavior (e.g. change in work patterns, personal circumstances, revealed work stresses, etc.) 7/16

There will often be signals given off "left of boom” before they commit a more significant event. These can be used to intervene with discipline, but sometimes more helpfully as a trigger for support/counseling to address the root of the disgruntlement / other issues. 8/16

The usual array of preventative and detective controls in place to mitigate many other risks are critical here from background checks, identity/access management, data rights management, data leakage prevention and detection, logging and anomaly detection and so on. 9/16

2. Instantaneous Insider Risks. As the name implies, these can happen without warning and without pre-signaling. As they say in the trade, “if you hear the boom they’ve already missed you.” 10/16

Arguably, as organization’s digital defenses improve and limit the reach of attackers, we will see more of the tactics come back that pre-date digitization i.e. bribes, extortion, coercing an employee into doing something nefarious with no warning. 11/16

The key here is to “reduce the blast radius” of potential events. Specifically, to enumerate job roles and determine, if the person in that position went bad instantaneously, how bad would it be. 12/16

If the answer to that is beyond whatever your risk appetite is, then work needs to happen. This (*hard*) work includes designing interventions to adjust job roles to reduce blast radius, remembering this isn't just about theft or fraud, it could be destructive events. 13/16

Interventions can include: - reducing access to what is reasonable for the role - further redesigning the role to need less privileges - adding separation of duties or multi-party control - adding circuit breakers to reduce scale of potential damage 14/16

- creating means to fast undo actions - adding temporal breakers to delay invocation of activities (time to reverse) or time between progressions of activities (time to intervene) - prohibit direct change to environments and use policy control to mediate change - etc. 15/16