INSIDER THREATS BY: DENZEL GAY COSC 356

ROAD MAP What makes the insider threat important Types of Threats Logic bombs Ways to prevent

WHAT IS AN INSIDER THREAT? An insider threat is a malicious threat to an organization that comes from people within the organization, such as employees, former employees, contractors or business associates, who have inside information concerning the organization's security practices, data and computer systems.

WHAT IS AN INSIDER THREAT? The threat may involve Fraud The theft of confidential or commercially valuable information The theft of intellectual property The sabotage of computer systems

WHAT IS AN INSIDER THREAT? An insider may attempt to steal property or information for personal gain, or to benefit another organization or country. The threat to the organization could also be through malicious software left running on its computer systems by former employees, a so- called Logic bomb.

TYPES OF ATTACKS An attack can be active or passive. An "active attack" attempts to alter system resources or affect their operation. A "passive attack" attempts to learn or make use of information from the system but does not affect system resources.

LOGIC BOMBS A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files (such as a salary database trigger), should they ever be terminated from the company.

WAYS TO PREVENT INSIDER THREATS Institute periodic enterprise-wide risk assessments. The organization must take an enterprise-wide view of information security, first determining its critical assets, then defining a risk management strategy for protecting those assets from both insiders and outsiders.

WAYS TO PREVENT INSIDER THREATS Institute periodic security awareness training for all employees. All employees in an organization must understand that security policies and procedures exist, that there is a good reason why they exist, that they must be enforced, and that there can be serious consequences for infractions.

WAYS TO PREVENT INSIDER THREATS Enforce separation of duties and least privilege. Effective separation of duties requires the implementation of least privilege; that is, authorizing people only for the resources they need to do their jobs.

WAYS TO PREVENT INSIDER THREATS Use extra caution with system administrators and privileged users. Typically, logging and monitoring is performed by a combination of system administrators and privileged users. Therefore, additional vigilance must be devoted to those users.

WAYS TO PREVENT INSIDER THREATS

SOURCES threat threat