Unit Outline Information Security Risks, Part II

1. Unit OutlineInformation Security Risks, Part II Module 1: Password Security Module 2: Wireless Security Module 3: Unintentional Threats  Module 4: Insider Threats Module 5: Miscellaneous Threats Module 6: Summary

2. Module 4Insider Threats

3. Insider ThreatsLearning Objectives • Student will be able to: • Recognize insider threats of an organization • Identify different sources of insider threats • Classify perpetrators of insider threats • Determine relevant controls for protection against insider threats

4. Insider ThreatsDefinition • An authorized user of a system who • Unwittingly aids or directly performs bad actions • Performs bad actions with the best possible intentions • Intentionally performs bad actions (motivation is irrelevant) • Insider threat more insidious than external threats and may be harder to detect

5. Insider ThreatsPerpetrators • Proprietors • Moles • Inappropriate users • Cowboys in the organization who who consider themselves beyond any policy • Remote or traveling users • Disgruntled insiders • Malicious Employees

6. Insider ThreatsHoles • Weak security policies and procedures • Errors in configuration, assignment of roles and rights, or acceptable use • Inadequate training and controls that leads to inappropriate use of systems • Poor physical security • Traveling laptops (employee travel) • Inadequate screening of employees during hiring process • Lack of resources to support security

7. Insider ThreatsInside Hacker Penetration • Social engineering • Low tech but can be powerful • Mostly performed over the phone or e-mail • Impersonation • Encrypt your authentication in transit • User credentials should not be emailed • Hacker Penetration through Network • Modems on the network • Direct connect to analog lines • Analog/digital converters • Web capable phones • Wireless LANs • Portable Media (thumb drives)

8. Insider ThreatsProtection • Perform periodic security assessment • Internal process or external consultants • Upgrade authentication and authorization processes • Stay current with security technology • Install patches when available • Train the IT staff and users to avoid configuration mistakes (Not the best place to save money) • Develop and internal training program (train-the-trainer) • Follow the principle of least privilege (Do not give unnecessary permissions) • Ensure the repercussions to flaunting security policies are strong and well advertised

9. Insider ThreatsProtection Cont’d. • Incorporate audit tools in your information access and identity management systems • e.g. Active Directory, LDAP, Databases, File Servers • Eliminate legacy interoperability from new system requirement when performing upgrades to remove old vulnerabilities

10. Insider ThreatsProtection: Network Architecture • Defense in Depth • Introduce security in network design • Segment the internal network • Use switches instead of hubs • Enforce Policies diligently • Apply principle of least privilege • Audit logs and identify intrusions • Profile network behavior • Severely restrict privileged access to only security & network administrators

11. Insider ThreatsProtection: Segment Architecture • Use routers to segment the network • Disallow source routing, broadcast, and multicast • Use filters for: • Traffic permitted into and out of your network • Source & destination IP addresses entering and leaving each subnet

12. Insider ThreatsProtection: Least Privilege • Don’t allow all system admins root access to everything • Identify user requirements and disable un-needed services • Use Role Based Access Control (RBAC) • Remove operating system access from user workstations

13. Insider ThreatsProtection: Auditing & Profiling • Central console for all security system reports • Most networking equipment will support SYSLOG – use it • Establish Flow Monitoring – several good tools, including MRTG, nTOP, CISCO, etc… • DHCP – Establish long lease times to enable better auditing • Set time and protocol rules of engagement • Limit systems that don’t require access to the Internet

14. Insider ThreatsProtection: Bastion Awareness • Syslog your bastion routers • Virus scan and potentially content filter your e-mail • Proxy all outbound Internet protocols • Filter for appropriate content • Select firewalls that demand protocol compliance on outbound proxy

15. Insider ThreatsProtection: Tactics & Strategy Strategy without tactics is the slowest route to victory. Tactics without strategy is the noise before defeat. -- Sun Tzu Strategy • Prepare for intrusion • Plan procurements carefully • Map user/role access to data profiles • Ensure data tagging stays up to date • Build strong auditing – centralize it and analyze it • Build defense-in-depth • Understand your asset/risk profile and keep it up to date Tactics • Identification • Containment • Eradication • Recovery • Post-Mortem • Each new procurement supports strategic security goals

16. Insider ThreatsSummary • Internal threats can be more insidious than external threats • Security policy enactment and enforcement is critical for internal protection • Network can be designed to make it more secure • Training and education are key to the success of insider protection