Over the decade, there had been a constant debate amongst security professional regarding this topic. Back in 2008, Bruce Schneier pointed out that outsider attacks are much more frequent, but insider attacks typically cause more damage. The current situation with Edward Snowden seems to support this perspective.
President Obama recently stepped up efforts to combat insider leads of classified information within the federal government and associated contractors. Here’s an excerpt from a recent MSNBC article on this topic:
“… In addition to launching the Insider Threat Program, President Obama has prosecuted more alleged leakers than all other presidents in U.S. history combined. But the government’s response doesn’t even seem to have been particularly effective; two years after the launch Insider Threat Program, the NSA still failed to prevent Edward Snowden from leaking the details of PRISM.”
What is clear is that federal agencies have taken steps over the past two years to address the insider threat situation. Here are some of the related questions and answers from the Peace Corps and others regarding actions taken:
“… The Peace Corps takes very seriously the obligation to protect sensitive information and is working to implement Executive Order 13587 as directed by the President. The agency has identified a senior official to oversee classified information sharing, safeguarding efforts, and implementation of an insider threat detection and prevention program. The agency has conducted the required internal assessment, and a cross-departmental team of Peace Corps staff has been identified and trained to support the program. The Peace Corps is working in coordination with the National Insider Threat Task Force to ensure the security of classified networks and the responsible sharing and safeguarding of classified information.”
Two Newer Insider Threats
I wrote a piece last week for Chief Security Officer (CSO) Magazine which described two new insider threats to consider, which include the conscientious objector in your midst as well as wearable technology.
I think more public and private sector staff, who disagree with their company’s ethics, policies or procedures, will take unauthorized actions in the future. Or, employees will go public with management’s enforcement (or lack thereof) regarding security or privacy policies, rather than work through company
prescribed guidelines.
Another hot topic in the press right now is wearable technology from glasses to watches to gloves. While this new technology is getting a mixed greeting from privacy advocates, most experts see wearable technology as inevitable. But are enterprises ready? Will wearable technology become another aspect of bring your own device (BYOD) to work anytime soon?
Moving Forward
Dealing with insider threats has been hard for years. No one is exempt from dealing with our changing technological landscape or our own role in helping secure the enterprise.
Still, one key mitigation step is to adopt more transparency regarding company policies and the corresponding back-office behaviors of employees regarding security and privacy. New technology involving the use of “big data” makes this topic especially important as we move into 2014. Second, start a conversation with your employees. Work through issues the old fashioned way – do lunch (or coffee). Take advantage of the innovative ideas and even concerns of your team members.
You can also implement Security Information and Event Management (SIEM) to help improve your log management and oversight of who is doing what on your networks – especially with critical and sensitive data. The “double check” methods and having clearly identified controls and processes in place to enforce security is an excellent way to deter insider threats.
In conclusion, I wrote this blog over three years ago which asks: Are you an insider threat? The problems of building trustworthy teams only seems to be getting more difficult in 2013. One friend asked, if NSA – with all of their technology, polygraphs, and background checks – has problems, what hope do we have?
I don’t have any simple answers for these new insider threat scenarios. But two final resources from the RSA conference and CERT.org may provide some ideas and further support on addressing insider threats.
Also, this website is a great resource: http://www.cert.org/insider_threat/
More on this insider threat topic later this summer…
What your opinion, are insiders or external threats the greater IT risk right now?
