Privacy in the Workplace and Threat Monitoring

1. Privacy in the Workplace and Threat Monitoring By Marc-Andre Frigon

2. This disclaimer informs you that the views, thoughts, and opinions expressed in this presentation belong solely to the author, and not necessarily to the author’s employer, organization, committee or other group or individual. Disclaimer #2- I’m making shortcut in the presentation to keep the flow.

3. Who Am I? • About 20 years of passion for Information Security • Practitioner, from the trenches, in various roles and industries • GRC • Architecture • Operations • Privacy interest for more then 10 years • About the same period of interest for privacy in the workplace • Involvement in global organizations • Canada, USA, Europe (France, Germany, Switzerland, Finland, UK, etc.), India, China, …

4. Agenda • The risks • Security measures • Privacy in the workplace • Conclusions

5. The risk(s)

6. Verizon Data Breach Investigation ReportAnalysis by Thycotic Top Breaches: • Phishing • Use of Stolen Credentials • Backdoors or C2 (Command and Control) Email is still the top delivery method of cyber attacks and Office Documents are the top file types used to infect systems. Phishing is the most common technique used to gain trust. The human is the top target as so many are likely to click on the links or unknowingly give over their credentials—including their password.

7. Mitre ATT&CK • Adversarial Tactics Techniques and Common Knowledge framework available from MITRE. • It is a curated knowledge base of 11 tactics and hundreds of techniques that attackers can leverage when compromising enterprises. • 11 tactics  • Initial Access • Execution • Persistence • Privilege Escalation • Defense Evasion • Credential Access • Discovery • Lateral Movement • Collection • Exfiltration • Command and Control

9. Threat landscape has change Hacker don’t break in anymore, they login (I think it is a Cisco guy quote)

10. The risk is real. • Threat is real • Known tactics and technics • Attacker are fast • Vulnerability is real • People are abusable • People give away their credentials • Impact is real

11. Counter measures

12. “Prevention is Ideal, but Detection is a MUST” • Dr. Eric Cole • Prevent, Detect, Respond • Allocate resources wisely • Breach are inevitable, but DETECTION TIME & response is what makes the differences

13. Prevent?

14. Detection is a MUST … log everything! • Endpoint protection + EDR, sysmon, Osquery, UBA, etc. • Network traffic capture (netflow, pcap, etc.) • Egress traffic monitoring (including https inspection) • Authentication attempts • Critical Servers and services logs • DNS • …

15. Detection is a MUST -> log everything!

16. Detection is a MUST How do you differentiate legatine users from a compromised account?

18. Security Operation Center (SOC) armed with Mitre ATT&CK • SIEM - automated log analysis • Skills people looking for hints of attack • Blue team • Playbook

19. Privacy in the workplace

20. Privacy Law (USA) Laws basically allow employers to monitor employees except in changing rooms or bathrooms, employees are starting to question the methods that employers are using to monitor employees.

22. In the Privacy Law class (in USA) Students over the years have been surprised that there are so few laws that govern employees’ privacy in the work place, and in general believe that workers have an expectation of privacy. The law doesn’t really reflect this assumption.

24. Privacy at work in Canada • Shortcut -> pretty much the same as USA

25. WORKPLACE PRIVACY AND EMPLOYEE MONITORING • Computers and Workstations • Email and Instant Messaging • Telephones • Mobile Devices • Audio and Video Recording • Location (GPS) Tracking • U.S. Postal Mail • Social Media

26. Legally acceptable How to it without demoralizing the employees?

27. My first experience with privacy in the workplace Creation of a Security Operation Center • Late 2008 (more than a year of effort & $) • SIEM gathering logs for perimeter technologies & DMZ systems • NIPS/HIPS • FW • Web proxies • … • SOC main objective: detect external attacks NOTE: Unionized environment

30. The union representative came to meet us … because they felt we were snooping on the employees

32. European countries (shortcut) • Strong expectations of privacy in the workplace • Inalienable right under some conditions • Less liability on the enterprise if security incident occur

33. Switzerland = FULL PRIVACY if you allow personal use

34. Published in 2005

36. Global vs local

37. But monitoring is needed. Now how to make it good?

38. The world is flat, take a global approach • Transparency & openness • Keep in mind the bigger goal (support an organisational objective) • Hidden vs accepted (communication & change management) • Invasive (intrusive) vs respectful • Machine inspection (less) vs human analysis (more sensitive) • Anomaly detection • Eavesdropping vs traffic analysis • Don’t decrypt everything (hidden gardens – banking, medical, etc.) • Account vs person

39. If it a good idea, you should be able to speak it in front of everyone

40. Work with employees • Monitor accounts not employees • Insider threat (malicious or error) is out of scope • Explain the why & how • Explain the why & how • Explain the why & how • Explain the why & how • …

41. At the moment you think you have done too much communication; is when you start having done enough.

42. “Prevention is Ideal, but Detection is a MUST”

43. Focus all effort on raising attacker costs • Ref: https://www.slideshare.net/PlatformSecurityManagement/asmc-2017-martin-vliem-security-lt-productivity-lt-security-syntax-error

44. Zero trust model – CORE CONCEPTS

45. Key takeaways 1. Privacy in workplace matters – review your practices • The world is not that flat, but make your program • Trust your people, but focus on account compromised • Be more respectful then invasive (intrusive) 2. Integrate new approaches reconciling privacy with corporate security “Freedom and democracy cannot exist without privacy” (Daniel Therrien is the Privacy Commissioner of Canada)

48. Security risks to organizations are pretty common, but privacy expectations in the workplace vary across the globe. The challenge is how to properly secure a global organization while not crossing the thin line between protecting the organization while not demoralizing employees. Not only would some expect a form of privacy at work, but things like end-to-end encryption have led to new methods that will ensure that security incidents are promptly detected.

49. Key takeaways • The world is not that flat • Trust your people, but focus on account compromised • Be more respectful then invasive (intrusive) • Lookout for new approaches reconciling privacy and security “Freedom and democracy cannot exist without privacy” (Daniel Therrien is the Privacy Commissioner of Canada)