Upload File

insider threat mitigation strategies that protect …...the cert national insider threat center-1...

  • Home
  • Documents
  • Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S
17
1 2010 CyLab Partners Conference Human Factors in Privacy and Security © 2019 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non‐US Government use and distribution. ] [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Insider Threat Mitigation Strategies that Protect Privacy and Civil Liberties Randy Trzeciak

Upload: others

Post on 26-May-2020

4 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

12010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution.

Software Engineering InstituteCarnegie Mellon UniversityPittsburgh, PA 15213

Insider Threat Mitigation Strategies that Protect Privacy and Civil Liberties

Randy Trzeciak

Page 2: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

22010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Document Markings

Copyright 2019 Carnegie Mellon University.

This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center.

The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation.

NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution.

This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at [email protected].

DM19-0940

Page 3: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

32010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Randall (Randy) Trzeciak

Software Engineering Institute; CERT Division; Cyber Risk and Resilience Directorate

Director National Insider Threat Center

Heinz College; School of Information Systems & Management

Program Director: MS Information Security Policy & Management

CERT Faculty

Page 4: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

42010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

What is the National Insider Threat Center?

Page 5: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

52010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

The CERT National Insider Threat Center-1

Center of insider threat expertise

Began working in this area in 2001 with the U.S. Secret Service

Mission: enable effective insider threat mitigation, incident management practices, and develop capabilities for deterring, detecting, and responding to evolving cyber and physical threats

Action and Value: conduct research, modeling, analysis, and outreach to develop & transition socio-technical solutions to combat insider threats

Page 6: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

62010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

SEI/CERT/NITC: Leader in Insider Threat Research

We possess a unique combination of• empirical evidence• modeling and simulation expertise• software engineering expertise• cybersecurity expertise• DoD mission space knowledge• data science expertise• collaborative research relationships with a cadre of multidisciplinary experts in social

and behavioral sciences

Our focus on developing repeatable, verifiable, and context-aware processes and preventative controls is a key differentiator between our applied research and system integrators

Page 7: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

72010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Operational Research Capabilities

Splunk Query Name: Last 30 Days - Possible Theft of IPTerms: 'host=HECTOR [search host="zeus.corp.merit.lab" Message="A user account was disabled. *" | evalAccount_Name=mvindex(Account_Name, -1) | fields Account_Name | strcat Account_Name "@corp.merit.lab" sender_address | fields - Account_Name] total_bytes > 50000 AND recipient_address!="*corp.merit.lab" startdaysago=30 | fields client_ip, sender_address, recipient_address, message_subject, total_bytes'

Page 8: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

82010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

CERT’s Critical Path to Insider Risk

•Medical / Psychiatric Conditions•Personal or Social Skills•Previous Rule Violations•Social Network Risks

Personal Predispositions

•Personal•Professional•FinancialStressors

•Interpersonal        Personnel•Technical                Mental Health•Security                  Social Network•Financial                Travel

Concerning Behaviors

•Inattention•No risk assessment process•Inadequate investigation•Summary dismissal or other actions that escalate risk

Problematic Organization Responses

Harmful            Act

Source: Shaw, Sellers (2015) ; Carnegie Mellon University (2006 ‐Present)

Page 9: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

92010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Insider Incident Types (not exhaustive)National Security Espionage IT System Sabotage Theft of IP – Entitled Independent

Theft of IP – Ambitious LeaderFraudEspionage / Sabotage

Page 10: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

102010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Recent Publications

Page 11: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

112010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

• Insider Threat BlogPatterns and Trends in Insider Threat Across Sectors (9 part series)

Improving Insider Threat Detection Methods Through Software Engineering Principles

High-Level Technique for Insider Threat Program's Data Source Selection

Windows Event Logging for Insider Threat Detection

• Common Sense Guide to Mitigating Insider Threats, Sixth Edition

• Navigating the Insider Threat Tool Landscape: Low-Cost Technical Solutions to Jump-Start an Insider Threat Program

• The Critical Role of Positive Incentives for Reducing Insider Threats

• Analytic Approaches to Detect Insider Threats

• Effective Insider Threat Programs: Understanding and Avoiding Potential Pitfalls

Recent Publications

Page 12: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

122010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Best Practices for Mitigation of Insider Threats

Page 13: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

132010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Key Components of an Insider Threat Program

Page 14: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

142010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Recommended Best Practices for Insider Threat Mitigation1 - Know and protect your critical assets. 12 - Deploy solutions for monitoring employee actions and

correlating information from multiple data sources.2 - Develop a formalized insider threat program. 13 - Monitor and control remote access from all endpoints,

including mobile devices.3 - Clearly document and consistently enforce policies and controls.

14 - Establish a baseline of normal behavior for both networks and employees

4 - Beginning with the hiring process, monitor and respond to suspicious or disruptive behavior.

15 - Enforce separation of duties and least privilege.

5 - Anticipate and manage negative issues in the work environment.

16 - Define explicit security agreements for any cloud services, especially access restrictions and monitoring capabilities.

6 - Consider threats from insiders and business partners in enterprise-wide risk assessments.

17 - Institutionalize system change controls.

7 - Be especially vigilant regarding social media. 18 - Implement secure backup and recovery processes.8 - Structure management and tasks to minimize unintentional insider stress and mistakes.

19 - Close the doors to unauthorized data exfiltration.

9 - Incorporate malicious and unintentional insider threat awareness into periodic security training for all employees.

20 - Develop a comprehensive employee termination procedure.

10 - Implement strict password and account management policies and practices.

21 - Adopt positive incentives to align the workforce with the organization.

11 - Institute stringent access controls and monitoring policies on privileged users.

http://resources.sei.cmu.edu/library/asset‐view.cfm?assetID=540644 or search “cert common sense guide insider threat”

Page 15: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

152010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Open Source Insider Threat (OSIT) Information Sharing Group

Page 16: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

162010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

Community of Interest for insider threat program practitioners across industry organizations

Over 400 members from ~155 organizations

Special Interest Groups - Banking / Finance- Data Analytics- Privacy

Monthly Telecons- Tool Vendor Demos

Bi-annual In-Person Meetings- Hosted by various members of the group

To join, contact:[email protected]

Open Source Insider Threat (OSIT) Information Sharing Group

Page 17: Insider Threat Mitigation Strategies that Protect …...The CERT National Insider Threat Center-1 Center of insider threat expertise Began working in this area in 2001 with the U.S

172010 CyLab Partners ConferenceHuman Factors in Privacy and Security© 2019 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non‐US Government use and distribution.]

National Insider Threat Center websitehttp://www.cert.org/insider-threat/

National Insider Threat Bloghttps://insights.sei.cmu.edu/insider-threat/

Randall F. Trzeciak

Director – National Insider Threat Center

CERT Division / Software Engineering Institute

412.268.7040

[email protected]

For More Information


Forcepoint Insider Threat · Forcepoint Insider Threat Empowers Your Organization Forcepoint Insider Threat saves you time and effort by automatically scoring and prioritizing your

Insider Threats: Practical Methods for Analysis and …...The CERT Insider Threat Center • Center of insider threat expertise • Began working in this area in 2001 with the U.S

Insider Threat Experiences

Insider Threat in IT

Radicalisation and Insider Threat

The Insider Threat: Lessons Learned from Actual Insider … · The Insider Threat: Lessons Learned from Actual Insider Attacks Randall Trzeciak Insider Threat Center at CERT ... Public

Insider Threat Control: Using Centralized Logging to ...€¦ · 2 CERT Insider Threat Database The CERT Insider Threat Center database currently contains more than 600 cases of actual

Insider Threat Records Checks...Insider Threat Records Checks Student Guide September 2017 Center for Development of Security Excellence Page 1-1 Lesson 1: Course Introduction Introduction

2016 Insider Threat Report - Crowd Research Partnerscrowdresearchpartners.com/wp-content/uploads/2017/07/Insider... · insider threat spotlight report 5 insider threats and vulnerability

Insider Threats - University of Pittsburgh · Unintentional Insider Threat Definition • An unintentional insider threat is (1) a currentAn unintentional insider threat is (1) a

Managing insider threat

Insider Threat Detection - Amazon S3...Insider Threat Detection: Behavioral Pattern Analysis to Identify Risks Dave Gebala & Hannah Chen Aster Solutions, Center of Innovation At Teradata,

Developing a Multidisciplinary Insider Threat Capability...Developing a Multidisciplinary Insider Threat Capability Student Guide September 2017 Center for Development of Security

Evolving Insider Threat Detection

inSider threat - Bitpipedocs.media.bitpipe.com/.../item_465972/Insider-Threat-Report-2015.pdf · share the insider threat spotlight report 8 Privileged users, such as managers with

Insider Threat

The Insider Threat

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

Insider Threat Mitigation Responses - CDSE · Insider Threat Mitigation Responses Student Guide September 2017. Center for Development of Security Excellence. Page 1-1 . Lesson 1:

Insider threat kill chain

Insider threat v3

DOD Insider Threat Management and Analysis Center Handout 3-2... · JUNE, 2015 COUNTERINTELLIGENCE AWARENESS WEBINAR SERIES DOD Insider Threat Management and Analysis Center MARCH

2015 VORMETRIC INSIDER THREAT REPORT · INSIDER THREAT REPORT Trends and Future Directions in Data Security Sponsoring Partners . 2015 Vormetric Insider Threat Report HealthcareRetail

Unintentional Insider Threats: Social Engineering · PDF fileUnintentional Insider Threats: Social Engineering The CERT® Insider Threat Center Produced for Department of Homeland

Insider Threat Mitigation

2018 Insider Threat Report - Crowd Research Partnerscrowdresearchpartners.com/.../2017/07/Insider-Threat-Report-2018.pdf · The resulting Insider Threat Report is the most comprehensive

What Makes Interset Different Part 1€¦ · Insider Threat Vs Inside Threat There is a distinction to be made between an ‘insider threat’ and an ‘inside threat.’ An insider

Current Trends in Insider Threat Detection Capability ... Threa… · The CERT Insider Threat Center • Center of insider threat expertise • Began working in this area in 2001

INSIDER THREAT BUYERS GUIDE...BUYERS GUIDE Detect, Investigate, & Respond 2 THE RISK: INSIDER THREAT Insider threat is the fastest growing risk your organization faces, with insider

Developing Your Insider Threat Program: Insider Threat Best Practices

Real-world Cases of Insider Threat: Combating Malicious IT ... · The CERT Insider Threat Center The CERT Insider Threat Center is a Center of Insider Threat Expertise at the Software

Network Security, Incident Management, and Insider … · Network Security, Incident Management, and Insider Threats ... 2. Insider Threat Agenda. ... Insider Threat Issue

Insider Threat and Security Clearance Reform · Insider Threat and Security Clearance Reform Goal Leaders: ... • Conducted scenario-based training course for Insider Threat program

INSIDER THREAT - Optiv · Insider Threat Defined While insider threat has been defined in many different ways, Optiv defines insider threat as: “An insider threat is an employee,

Insider threat event presentation