WEBVTT

00:03.139 --> 00:06.120
>> Employee termination
procedures.

00:06.120 --> 00:08.790
We don't necessarily want
to terminate employees,

00:08.790 --> 00:10.530
but oftentimes it's a matter,

00:10.530 --> 00:12.795
of course, and we're
going to have to do that.

00:12.795 --> 00:14.520
When we do, we want to develop

00:14.520 --> 00:16.650
an enterprise-wide
checklist to use what

00:16.650 --> 00:18.870
someone separates from
the organization,

00:18.870 --> 00:20.910
and you want there
to be some type of

00:20.910 --> 00:23.085
process for tracking
all accounts,

00:23.085 --> 00:25.110
assigned to each employee.

00:25.110 --> 00:28.020
At the end of their
termination proceeding,

00:28.020 --> 00:30.990
you want to reaffirm
with them all

00:30.990 --> 00:33.660
nondisclosure and intellectual
property agreements

00:33.660 --> 00:35.605
as part of that
termination process.

00:35.605 --> 00:37.410
Again, you're just

00:37.410 --> 00:41.250
re-solidifying everything
that they had already signed.

00:41.250 --> 00:42.290
That way you can take

00:42.290 --> 00:45.110
appropriate legal action
against them if necessary.

00:45.110 --> 00:47.450
You want to notify all employees

00:47.450 --> 00:49.160
about any employee's departure,

00:49.160 --> 00:50.935
where permissible
and appropriate,

00:50.935 --> 00:53.210
it doesn't have
to be essentially

00:53.210 --> 00:57.815
a very inappropriate or ugly
way of notifying everyone,

00:57.815 --> 00:59.630
but you could essentially,

00:59.630 --> 01:01.970
nicely put so and so has

01:01.970 --> 01:04.700
departed or left the organization
that way everyone is

01:04.700 --> 01:07.040
informed and they don't find it

01:07.040 --> 01:09.710
funny when this person
shows back up at

01:09.710 --> 01:12.560
the office and there's
some confusion as to why

01:12.560 --> 01:14.960
this person is here
if they should

01:14.960 --> 01:16.209
>> or shouldn't be there.

01:16.209 --> 01:17.905
>> Next, you want to archive,

01:17.905 --> 01:19.240
block access to all accounts

01:19.240 --> 01:21.895
associated with that
departed employee.

01:21.895 --> 01:24.360
Then you want to collect all of

01:24.360 --> 01:26.345
the departing employee's
company-owned equipment

01:26.345 --> 01:29.500
before he or she leaves
the organization.

01:29.500 --> 01:31.450
That way that's going
to limit the amount

01:31.450 --> 01:33.130
of access they have

01:33.130 --> 01:37.025
to your company's network
and data after they leave.

01:37.025 --> 01:38.850
Next, you want to establish

01:38.850 --> 01:41.050
a physical-inventory system that

01:41.050 --> 01:44.440
tracks all assets issued
to that employee,

01:44.440 --> 01:46.685
that way you know what to get.

01:46.685 --> 01:48.565
You want to ensure that you

01:48.565 --> 01:50.620
get those very
sensitive items back.

01:50.620 --> 01:52.960
If you have some type of
hand receipt in those items,

01:52.960 --> 01:54.070
you'd know what
you're looking for.

01:54.070 --> 01:56.095
Again it's hard to figure out

01:56.095 --> 01:59.180
what wrong is if you don't
know what right looks like.

01:59.180 --> 02:01.510
Lastly, conduct an inventory of

02:01.510 --> 02:02.995
all information systems and

02:02.995 --> 02:05.380
audit the accounts
on those systems.

02:05.380 --> 02:07.480
Especially if the employee knows

02:07.480 --> 02:08.080
>> that they were going to

02:08.080 --> 02:10.915
>> get fired or has started
planning on leaving.

02:10.915 --> 02:13.860
If they were working on
this high-valued project.

02:13.860 --> 02:17.940
You want to go in and start
auditing those accounts.

02:17.940 --> 02:19.210
Just to look for anomalies

02:19.210 --> 02:21.309
>> and some of those indicators.

02:21.309 --> 02:23.405
>> Backup and recovery.

02:23.405 --> 02:26.150
Obviously, you want store
backup media off-site,

02:26.150 --> 02:28.960
ensure media is protected
from unauthorized access,

02:28.960 --> 02:31.869
and only be retrieved by
small number of individuals.

02:31.869 --> 02:33.070
We talked on this,

02:33.070 --> 02:34.930
obviously, if this
is the information,

02:34.930 --> 02:37.190
you're going to depend on in
the event of an emergency,

02:37.190 --> 02:38.770
you want to ensure

02:38.770 --> 02:41.350
that it's going to be
there when you need it.

02:41.350 --> 02:44.855
Utilize professional
off-site storage facility.

02:44.855 --> 02:48.505
Don't send backup media
home with employees.

02:48.505 --> 02:51.145
This is critical information.

02:51.145 --> 02:53.120
You'll want to make sure
that it's ready for

02:53.120 --> 02:56.030
your use and encrypting
the backup media and

02:56.030 --> 02:57.230
manage the encryption keys to

02:57.230 --> 03:01.680
ensure backups and
recovery are possible.

03:01.680 --> 03:04.500
Again protect your backup data.

03:04.500 --> 03:06.560
Living on, ensure that
configurations of

03:06.560 --> 03:08.630
network infrastructure
devices, routers,

03:08.630 --> 03:10.410
switches, and
firewalls are part of

03:10.410 --> 03:13.320
your the organization's
backup recovery plan as well.

03:13.320 --> 03:17.345
In part of that business
continuity planning process,

03:17.345 --> 03:19.820
you want to know what's going to

03:19.820 --> 03:23.090
have to be in
operation if you have

03:23.090 --> 03:24.770
>> to start backing up and going

03:24.770 --> 03:28.195
>> to executing that
business continuity plan.

03:28.195 --> 03:31.160
Next is, implement a backup
and recovery process

03:31.160 --> 03:33.005
that involves at
least two people,

03:33.005 --> 03:34.520
a backup administrator,

03:34.520 --> 03:36.010
and a restore administrator.

03:36.010 --> 03:38.780
Both people should be able
to perform either role.

03:38.780 --> 03:41.060
But essentially,
you have two people

03:41.060 --> 03:43.370
on-site to be able to do that.

03:43.370 --> 03:47.860
That way you can ensure
a separation of duties.

03:47.860 --> 03:52.110
Regularly test both backup
and recovery processes.

03:52.110 --> 03:53.660
Ensuring that your organization

03:53.660 --> 03:56.090
can reconstitute
all critical data

03:56.090 --> 03:58.400
as defined by the
business continuity plan

03:58.400 --> 04:00.185
or disaster recovery plan.

04:00.185 --> 04:02.150
Ensure this process
does not rely

04:02.150 --> 04:04.840
on any single person
to be successful.

04:04.840 --> 04:06.830
It's more than
just going through

04:06.830 --> 04:09.770
the motions of this process.

04:09.770 --> 04:11.840
In the last lesson,

04:11.840 --> 04:14.060
we'll talk in-depth about
some case studies of

04:14.060 --> 04:17.000
people who did do business
continuity planning.

04:17.000 --> 04:19.610
They just didn't do
a good job of doing

04:19.610 --> 04:21.980
the business continuity
planning and some of

04:21.980 --> 04:23.720
the events that they
should have foreseen,

04:23.720 --> 04:24.679
>> they did not.

04:24.679 --> 04:27.305
>> When it came time
to execute that plan,

04:27.305 --> 04:30.410
it was done in a
manner that was not

04:30.410 --> 04:34.390
good and they were not able
to continue operations.

04:34.390 --> 04:37.025
Lastly, sabotage,

04:37.025 --> 04:39.590
behavioral issues should be

04:39.590 --> 04:42.649
>> reported by management to HR.

04:42.649 --> 04:45.980
>> If you see someone
continually acting out,

04:45.980 --> 04:47.810
continually being a problem,

04:47.810 --> 04:51.890
some of those indicators
should be present and they may

04:51.890 --> 04:56.995
begin to start conducting
this subversive activity.

04:56.995 --> 04:59.600
The HR should notify

04:59.600 --> 05:02.660
the insider threat team and
then they can start doing

05:02.660 --> 05:04.400
their investigation
hopefully before

05:04.400 --> 05:08.575
the fact of someone actually
subverting the system.

05:08.575 --> 05:11.640
The insider threat team
conducts an inquiry of

05:11.640 --> 05:13.910
past and present
online activity and

05:13.910 --> 05:16.285
projects future online activity.

05:16.285 --> 05:18.806
Again, it's looking
for those sensors

05:18.806 --> 05:20.720
>> and indicators and
trying to come up

05:20.720 --> 05:24.180
>> with a picture of
what might occur.

05:24.229 --> 05:26.280
>> Theft of IP.

05:26.280 --> 05:29.940
An employee who has access
to sensitive information,

05:29.940 --> 05:32.400
our intellectual property
such as trade secret,

05:32.400 --> 05:35.385
source code, engineering
or scientific info,

05:35.385 --> 05:37.040
strategic plans, the recipe for

05:37.040 --> 05:39.170
Colonel Sanders chicken quits.

05:39.170 --> 05:41.465
You want to start doing

05:41.465 --> 05:44.240
an investigation
of that employee,

05:44.240 --> 05:45.875
what they had access to.

05:45.875 --> 05:48.470
HR should notify the
insider threat team

05:48.470 --> 05:50.120
to conduct an inquiry on past

05:50.120 --> 05:53.134
>> and present online
activity and to project

05:53.134 --> 05:54.650
>> future online activity with

05:54.650 --> 05:57.035
a particular focus on
logs and activity for

05:57.035 --> 06:00.980
30 days before and after
the insider resigned.

06:00.980 --> 06:02.645
That's just covering your basis,

06:02.645 --> 06:04.475
making sure that that data

06:04.475 --> 06:06.940
did not leave with
that employee.

06:06.940 --> 06:09.360
Moving on, we talk about fraud.

06:09.360 --> 06:11.000
An employee is experiencing

06:11.000 --> 06:12.560
extreme financial difficulty or

06:12.560 --> 06:14.210
has had a sudden unexplained

06:14.210 --> 06:16.234
>> change in financial status.

06:16.234 --> 06:21.185
>> We've talked about the
indicator that undo athletes,

06:21.185 --> 06:23.750
management should
tell security or HR,

06:23.750 --> 06:27.650
which will then inform the
insider threat team of

06:27.650 --> 06:30.830
that potential indicator that

06:30.830 --> 06:32.510
that person may be
an insider threat.

06:32.510 --> 06:35.930
The insider threat team
would increase monitoring of

06:35.930 --> 06:38.960
financial transaction
data and PII

06:38.960 --> 06:43.050
that could be susceptible to
financial theft or fraud.

06:43.070 --> 06:46.110
Creating these insider
threat programs,

06:46.110 --> 06:47.840
ensure that legal
counsel determines

06:47.840 --> 06:49.625
the framework the
team will work in.

06:49.625 --> 06:52.610
Obviously, you want to be
within the confines of

06:52.610 --> 06:54.530
the law and everything that

06:54.530 --> 06:57.605
insider threat team
does should be legal.

06:57.605 --> 07:00.170
You want to establish
policies and procedures

07:00.170 --> 07:02.690
for addressing insider
threats that include HR,

07:02.690 --> 07:05.930
legal security management,
and information assurance.

07:05.930 --> 07:08.630
You also want to
consider establishing

07:08.630 --> 07:11.255
a contact with an
outside consulting firm,

07:11.255 --> 07:13.505
that is capable of providing

07:13.505 --> 07:15.590
incident response
capabilities for

07:15.590 --> 07:17.315
all types of incidence.

07:17.315 --> 07:19.730
If the organization
has not yet developed

07:19.730 --> 07:21.860
the expertise to conduct

07:21.860 --> 07:24.235
the legal objective
and thorough inquiry.

07:24.235 --> 07:26.490
If you don't know how to do it,

07:26.490 --> 07:28.920
find someone that does.

07:28.920 --> 07:31.594
Formalize an insider
threat program

07:31.594 --> 07:33.290
with a senior official
of the organization

07:33.290 --> 07:34.910
appointed as the program
manager that can

07:34.910 --> 07:37.690
monitor for and respond
to the insider threats.

07:37.690 --> 07:40.280
Implement insider
threat detection rules

07:40.280 --> 07:42.620
into your detection systems.

07:42.620 --> 07:44.870
Review logs on a
continuous basis

07:44.870 --> 07:46.960
and ensure watch
lists are updated.

07:46.960 --> 07:50.330
Lastly, ensure the insider
threat team meets on

07:50.330 --> 07:55.200
a regular basis and
maintains a readiness state.

07:55.520 --> 07:58.155
Establishing a baseline.

07:58.155 --> 07:59.840
We talked about
if you don't know

07:59.840 --> 08:00.980
>> what right looks like,

08:00.980 --> 08:03.290
>> it's hard to figure out
what wrong looks like.

08:03.290 --> 08:05.270
Use network monitoring tools

08:05.270 --> 08:06.860
to monitor the network
for a period of

08:06.860 --> 08:08.885
time to establish baseline

08:08.885 --> 08:10.900
of normal activities and trends.

08:10.900 --> 08:13.910
You want to deny VPN access
to foreign countries

08:13.910 --> 08:16.895
where a genuine business
need does not exist,

08:16.895 --> 08:18.920
and you want to white
list countries where

08:18.920 --> 08:21.115
a genuine business
need does exist.

08:21.115 --> 08:22.985
You want to establish

08:22.985 --> 08:25.520
which ports and
protocols are needed for

08:25.520 --> 08:27.230
normal network activity and

08:27.230 --> 08:30.745
configure devices to use
only those services.

08:30.745 --> 08:32.795
Next, you want to determine

08:32.795 --> 08:35.470
which firewall and IDS
alerts are normal.

08:35.470 --> 08:37.725
That way you know
what is abnormal.

08:37.725 --> 08:39.530
Either correct what causes

08:39.530 --> 08:41.060
these alerts or document normal

08:41.060 --> 08:42.140
ranges to include them

08:42.140 --> 08:45.475
with network baseline
documentation.

08:45.475 --> 08:48.790
You want to establish
network activity baselines

08:48.790 --> 08:51.650
for individual subunits
of the organization,

08:51.650 --> 08:53.140
and you want to determine

08:53.140 --> 08:54.820
which devices on
a network need to

08:54.820 --> 08:56.020
communicate with the others and

08:56.020 --> 08:58.510
implement access control list,

08:58.510 --> 09:00.040
firewall rules, and other

09:00.040 --> 09:02.975
technologies to limit
communications that should.

09:02.975 --> 09:06.250
Lastly, understand VPN
user requirements.

09:06.250 --> 09:09.220
You want to limit access to
certain hours and monitor

09:09.220 --> 09:11.680
bandwidth consumption
because that could be a way

09:11.680 --> 09:14.825
someone would easily take
data off your network.

09:14.825 --> 09:16.990
Established which
resources will be

09:16.990 --> 09:19.030
accessible via VPN and from

09:19.030 --> 09:21.610
what remote IP
addresses and you want

09:21.610 --> 09:25.190
to alert on anything that
is outside of the door.