The CERT Guide to Insider Threats How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud)

by Cappelli, Dawn M.; Moore, Andrew P.; Trzeciak, Randall F.

• ISBN13: 9780321812575
• ISBN10: 0321812573
• Edition: 1st
• Format: Hardcover
• Copyright: 2012-01-24
• Publisher: Addison-Wesley Professional

Summary

Wikileaks recent data exposures demonstrate the danger now posed by insiders, who can often bypass physical and technical security measures designed to prevent unauthorized access. Insiders are already familiar with their organizations'policies, procedures, and technologies, and can often identify vulnerabilities more effectively than outside "hackers." Most IT security mechanisms are implemented primarily to defend against external threats, leaving potentially enormous vulnerabilities exposed. Now, the insider threat team at CERT, the world's leading information security experts, helps readers systematically identify, prevent, detect, and mitigate threats arising from inside the organization. Drawing on their advanced research with the US Secret Service and Department of Defense, as well as the world's largest database of insider attacks, the authors systematically address four key types of insider "cybercrime": national security espionage, IT sabotage, theft of intellectual property, and fraud. For each, they present an up-to-date crime profile: who typically commits these crimes (and why); relevant organizational issues; methods of attack, impacts, and precursors that could have warned the organization in advance. In addition to describing patterns that readers can use in their own organizations, the authors offer today's most effective psychological, technical, organizational, cultural, and process-based countermeasures.

Author Biography

Dawn Cappelli, CISSP, is Technical Manager of the CERT Insider Threat Center and the Enterprise Threat and Vulnerability Management Team at Carnegie Mellon University’s Software Engineering Institute (SEI). She has spent the past decade working with organizations such as the U.S. Secret Service and Department of Homeland Security in protecting the United States against insider threats. Andrew Moore is Lead Researcher in the CERT Insider Threat Center and Senior Member of Technical Staff at SEI. Randall Trzeciak is a Senior Member of Technical Staff at SEI, and Technical Team Lead for the Insider Threat Research Group at the CERT Insider Threat Center.

Table of Contents

Preface xvii

Acknowledgments xxxi

 

Chapter 1: Overview 1

True Stories of Insider Attacks 3

The Expanding Complexity of Insider Threats 6

Breakdown of Cases in the Insider Threat Database 7

CERT’s MERIT Models of Insider Threats 9

Overview of the CERT Insider Threat Center 13

Timeline of the CERT Program’s Insider Threat Work. 16

Caveats about Our Work 20

Summary 20

 

Chapter 2: Insider IT Sabotage 23

General Patterns in Insider IT Sabotage Crimes 28

Mitigation Strategies 46

Summary 59

 

Chapter 3: Insider Theft of Intellectual Property 61

Impacts 66

General Patterns in Insider Theft of Intellectual Property Crimes 68

The Entitled Independent 69

The Ambitious Leader 78

Theft of IP inside the United States Involving Foreign Governments or Organizations 83

Mitigation Strategies for All Theft of Intellectual Property Cases 88

Mitigation Strategies: Final Thoughts 97

Summary 98

 

Chapter 4: Insider Fraud 101

General Patterns in Insider Fraud Crimes 106

Insider Fraud Involving Organized Crime 115

Organizational Issues of Concern and Potential Countermeasures 120

Mitigation Strategies: Final Thoughts 126

Summary 127

 

Chapter 5: Insider Threat Issues in the Software Development Life Cycle 129

Requirements and System Design Oversights 131

System Implementation, Deployment, and Maintenance Issues 136

Programming Techniques Used As an Insider Attack Tool 139

Mitigation Strategies 142

Summary 143

 

Chapter 6: Best Practices for the Prevention and Detection of Insider Threats 145

Summary of Practices 146

Practice 1: Consider Threats from Insiders and Business Partners in Enterprise-Wide Risk Assessments 151

Practice 2: Clearly Document and Consistently Enforce Policies and Controls 155

Practice 3: Institute Periodic Security Awareness Training for All Employees 159

Practice 4: Monitor and Respond to Suspicious or Disruptive Behavior, Beginning with the Hiring Process 164

Practice 5: Anticipate and Manage Negative Workplace Issues 168

Practice 6: Track and Secure the Physical Environment 171

Practice 7: Implement Strict Password- and Account-Management Policies and Practices 174

Practice 8: Enforce Separation of Duties and Least Privilege 178

Practice 9: Consider Insider Threats in the Software Development Life Cycle 182

Practice 10: Use Extra Caution with System Administrators and Technical or Privileged Users 187

Practice 11: Implement System Change Controls 191

Practice 12: Log, Monitor, and Audit Employee Online Actions 195

Practice 13: Use Layered Defense against Remote Attacks 200

Practice 14: Deactivate Computer Access Following Termination 203

Practice 15: Implement Secure Backup and Recovery Processes 207

Practice 16: Develop an Insider Incident Response Plan 211

Summary 213

References/Sources of Best Practices 214

 

Chapter 7: Technical Insider Threat Controls 215

Infrastructure of the Lab 217

Demonstrational Videos 218

High-Priority Mitigation Strategies 219

Control 1: Use of Snort to Detect Exfiltration of Credentials Using IRC 220

Control 2: Use of SiLK to Detect Exfiltration of Data Using VPN 221

Control 3: Use of a SIEM Signature to Detect Potential Precursors to Insider IT Sabotage 223

Control 4: Use of Centralized Logging to Detect Data Exfiltration during an Insider’s Last Days of Employment 231

Insider Threat Exercises 239

Summary 239

 

Chapter 8: Case Examples 241

Sabotage Cases 241

Sabotage/Fraud Cases 256

Theft of IP Cases 258

Fraud Cases 262

Miscellaneous Cases 269

Summary 273

 

Chapter 9: Conclusion and Miscellaneous Issues 275

Insider Threat from Trusted Business Partners 275

Malicious Insiders with Ties to the Internet Underground 286

Final Summary 293

 

Appendix A: Insider Threat Center Products and Services 299

Appendix B: Deeper Dive into the Data 307

Appendix C: CyberSecurity Watch Survey 319

Appendix D: Insider Threat Database Structure 325

Appendix E: Insider Threat Training Simulation: MERIT InterActive 333

Appendix F: System Dynamics Background 345

 

Glossary of Terms 351

References 359

About the Authors 365

Index 369