WEBVTT

00:03.409 --> 00:06.810
>> Social media policy,
you want to establish

00:06.810 --> 00:08.640
a social media
policy that defines

00:08.640 --> 00:10.770
acceptable uses of social media,

00:10.770 --> 00:14.445
and information that should
not be discussed online.

00:14.445 --> 00:17.745
One of the activities

00:17.745 --> 00:21.330
or methods that the
government was able to start

00:21.330 --> 00:24.420
looking for individuals is

00:24.420 --> 00:26.730
that people post a lot

00:26.730 --> 00:28.500
of data that they
shouldn't online.

00:28.500 --> 00:32.960
I think there was a case
where Vice News did

00:32.960 --> 00:34.490
a study of some of

00:34.490 --> 00:37.835
the Russian soldiers
who were in Crimea.

00:37.835 --> 00:40.655
Then based on this
person's post,

00:40.655 --> 00:45.515
they were able to determine
that this soldier,

00:45.515 --> 00:49.250
who was a Russian was
in Crimea and Vice News

00:49.250 --> 00:52.935
tracked this guy back
to his home in Siberia.

00:52.935 --> 00:56.000
This all the time was
during which Russia

00:56.000 --> 00:59.665
was saying that they weren't
not in Crimea at all.

00:59.665 --> 01:02.390
Knowing how to use social media,

01:02.390 --> 01:05.000
could be very important
to your organization.

01:05.000 --> 01:07.145
Hopefully you're not
invading Crimea.

01:07.145 --> 01:11.180
But again, that's just
a very extreme example.

01:11.180 --> 01:13.910
Improved social media
awareness training is part of

01:13.910 --> 01:16.910
the organization's security
awareness training program.

01:16.910 --> 01:19.040
You want to encourage
users to report

01:19.040 --> 01:20.900
suspicious emails or phone calls

01:20.900 --> 01:22.700
to the information
security team,

01:22.700 --> 01:24.860
who can track those
emails to identify

01:24.860 --> 01:27.985
any patterns in issue
alerts to users.

01:27.985 --> 01:30.470
Then lastly, consider
monitoring the use

01:30.470 --> 01:33.050
of social media across
the organization,

01:33.050 --> 01:35.540
limited to looking in
a manner approved by

01:35.540 --> 01:38.360
legal counsel for
postings by employees,

01:38.360 --> 01:41.460
contractors, and
business partners.

01:41.780 --> 01:44.970
Closing the door to
data exfiltration.

01:44.970 --> 01:48.020
You want to establish a
Cloud computing policy.

01:48.020 --> 01:51.505
You should be aware of
what Cloud services are

01:51.505 --> 01:53.115
operating and how employees can

01:53.115 --> 01:55.065
use them to exfiltrate data,

01:55.065 --> 01:56.780
and you want to
restrict or monitor

01:56.780 --> 01:58.670
what employees put
into the Cloud.

01:58.670 --> 02:00.680
Establishing some type of Cloud

02:00.680 --> 02:03.845
access security broker policy

02:03.845 --> 02:06.995
to do that is going to
be in your benefit.

02:06.995 --> 02:08.780
You want to monitor the use

02:08.780 --> 02:10.175
of printers, copiers, scanners,

02:10.175 --> 02:12.500
fax machines because
those are places where

02:12.500 --> 02:15.635
individuals could
abscond with data.

02:15.635 --> 02:18.530
You want to create a
data transfer policy

02:18.530 --> 02:20.060
and procedure to allow sensitive

02:20.060 --> 02:21.710
company information to be

02:21.710 --> 02:24.245
removed from the system
only in a controlled way.

02:24.245 --> 02:26.485
When it's removed, you
want to know it's removed.

02:26.485 --> 02:27.935
You want to establish

02:27.935 --> 02:29.300
a removable media policy and

02:29.300 --> 02:31.270
implement technologies
to enforce it.

02:31.270 --> 02:34.460
Some type of DLP technology
on your laptops to

02:34.460 --> 02:38.375
prevent devices from
being plugged in.

02:38.375 --> 02:43.610
Restrict data transfer
protocols such as FTP, SFTP,

02:43.610 --> 02:45.050
or SCP to employees with

02:45.050 --> 02:47.030
justifiable business
name and you want to

02:47.030 --> 02:48.800
monitor that use so you

02:48.800 --> 02:51.340
know what's going
over the FTP servers.

02:51.340 --> 02:53.870
Lastly, inventory
all connections

02:53.870 --> 02:55.565
to the organization's enclave.

02:55.565 --> 02:58.525
Ensure that SLAs and
your MOAs are in place.

02:58.525 --> 03:00.680
You want to verify
the connections are

03:00.680 --> 03:03.620
still in use and have a
justified business need.

03:03.620 --> 03:06.260
Obviously, you want
to know what's

03:06.260 --> 03:08.690
connected to your network,
why it's connected.

03:08.690 --> 03:10.550
If it's something
that you don't need,

03:10.550 --> 03:12.955
I would highly recommend
disconnecting.

03:12.955 --> 03:14.840
Lastly, we will talk about

03:14.840 --> 03:17.045
the case study of
Robert Hanssen.

03:17.045 --> 03:21.370
He was an insider
that was in the FBI.

03:21.370 --> 03:22.955
He was very trusted.

03:22.955 --> 03:28.125
Essentially, the FBI hired

03:28.125 --> 03:31.850
Robert Hanssen in charge
of trying to find himself.

03:31.850 --> 03:37.340
He wasted a lot of time of
the FBI trying to do so.

03:37.340 --> 03:40.405
During the time of his
alleged illegal activities,

03:40.405 --> 03:42.950
Hanssen was assigned to
New York and Washington

03:42.950 --> 03:46.205
DC where he held key
counterintelligence positions.

03:46.205 --> 03:48.680
Those were the individuals
who essentially

03:48.680 --> 03:51.285
looked for spies.
But he was one.

03:51.285 --> 03:52.920
As a result for his assignments,

03:52.920 --> 03:55.280
Hanssen had direct and
legitimate access to

03:55.280 --> 03:56.660
voluminous information about

03:56.660 --> 03:59.450
sensitive programs
and operations.

03:59.450 --> 04:04.369
Because he had access to
all of that information,

04:04.369 --> 04:07.100
he was trusted and

04:07.100 --> 04:09.500
he should not have been
trusted and he had

04:09.500 --> 04:12.920
numerous indicators about him

04:12.920 --> 04:15.905
that people should have
paid attention to.

04:15.905 --> 04:18.725
He did have massive amounts of

04:18.725 --> 04:21.150
money in his home

04:21.150 --> 04:23.930
when it was searched
and he was arrested.

04:23.930 --> 04:26.510
He had numerous
security violations.

04:26.510 --> 04:29.090
He had actually filled
up garbage bags,

04:29.090 --> 04:31.920
full of classified information,

04:31.920 --> 04:35.560
and walked down of the
FBI building with that.

04:35.560 --> 04:37.925
As part of that information,

04:37.925 --> 04:42.185
he gave up at least 10
FBI, CIA double agents.

04:42.185 --> 04:44.675
Possibly he gave up
General Polyakov a call,

04:44.675 --> 04:46.700
and at least three
of the individuals

04:46.700 --> 04:48.460
he gave up were executed.

04:48.460 --> 04:50.580
The General Polyakov source,

04:50.580 --> 04:53.285
he was a pretty valued source

04:53.285 --> 04:58.540
for our government
intelligence element.

04:58.540 --> 05:00.920
He provided many documents such

05:00.920 --> 05:02.720
as the Continuity of
Government planning,

05:02.720 --> 05:04.700
the National HUMINT
Collection Plans,

05:04.700 --> 05:07.160
over 6,000 pages of documents,

05:07.160 --> 05:08.960
and the details that the FBI had

05:08.960 --> 05:11.620
tunneled underneath of
the Soviet Embassy.

05:11.620 --> 05:14.410
He spied for more
than eight years and

05:14.410 --> 05:18.575
the extent of damage that he
caused may never be known.

05:18.575 --> 05:20.855
Currently, he is
serving a life in

05:20.855 --> 05:23.960
prison in a supermax
prison in Colorado.

05:23.960 --> 05:25.385
He will not be executed

05:25.385 --> 05:27.950
because individuals
still have to go and

05:27.950 --> 05:30.290
interview him and
talk to him about

05:30.290 --> 05:32.090
the extent of the damage that he

05:32.090 --> 05:34.570
caused the United
States government.

05:34.570 --> 05:38.585
This is again, a
very extreme example

05:38.585 --> 05:40.460
of an insider threat,

05:40.460 --> 05:44.480
but serves as what can happen

05:44.480 --> 05:46.790
when these individuals

05:46.790 --> 05:50.640
>> and these indicators
go unchecked.

05:51.619 --> 05:54.335
>> I know that was a
lot of information.

05:54.335 --> 05:57.620
But again, this is a very
important topic and something

05:57.620 --> 05:59.150
that a lot of organizations may

05:59.150 --> 06:01.270
not have been focusing on.

06:01.270 --> 06:03.935
If you're going to do anything
in your organization,

06:03.935 --> 06:07.880
it's very important
to understand one,

06:07.880 --> 06:09.860
what data you have
and what makes

06:09.860 --> 06:13.635
your organization special and
then how to protect them.

06:13.635 --> 06:16.480
Not just protect it from
people on the outside,

06:16.480 --> 06:18.710
but protect it from
people on the inside as

06:18.710 --> 06:21.380
well because
oftentimes those are

06:21.380 --> 06:24.140
going to be more
dangerous attacks

06:24.140 --> 06:26.960
than any external entity can be

06:26.960 --> 06:29.060
because these individuals
that are around

06:29.060 --> 06:33.805
you have gone through some
type of vetting process.

06:33.805 --> 06:36.560
When someone starts to
go off the rails or

06:36.560 --> 06:38.990
starts to become
that insider threat,

06:38.990 --> 06:41.000
there are different types

06:41.000 --> 06:43.160
of indicators that
we talked about,

06:43.160 --> 06:46.850
sensors that you can
look for and through

06:46.850 --> 06:48.530
to try and help whittle

06:48.530 --> 06:51.230
down who might be
an insider threat.

06:51.230 --> 06:55.010
Now again, not everyone
who exhibits some of

06:55.010 --> 06:58.825
those indicators is going
to be an insider threat.

06:58.825 --> 07:02.405
But when you start seeing
multiple indicators,

07:02.405 --> 07:04.759
that would essentially
be someone

07:04.759 --> 07:07.600
who would warrant
further suspicion.

07:07.600 --> 07:09.100
Again, we talked about

07:09.100 --> 07:11.660
the automated process of

07:11.660 --> 07:13.250
working through those
and how some of

07:13.250 --> 07:15.740
these technologies can establish

07:15.740 --> 07:18.470
a rank order of who might

07:18.470 --> 07:20.870
be an insider threat based on

07:20.870 --> 07:24.250
all of the data elements that
it's going to pull from.

07:24.250 --> 07:26.840
Then lastly, we
talked in-depth on

07:26.840 --> 07:29.375
creating the policies of how to

07:29.375 --> 07:34.670
enforce insider threat
policies and what to look for,

07:34.670 --> 07:36.305
how to train your employees,

07:36.305 --> 07:38.090
and then how to help secure

07:38.090 --> 07:42.950
your organization and
make it more resilient,

07:42.950 --> 07:46.165
or resistant to those
insider threats.

07:46.165 --> 07:49.460
This will conclude our talk

07:49.460 --> 07:51.200
>> today about insider threats.

07:51.200 --> 07:52.925
>> I hope you've enjoyed this.

07:52.925 --> 07:54.860
If you have any questions,

07:54.860 --> 07:57.240
please feel free to email

07:57.240 --> 08:00.870
in any questions
that you might have.

08:00.870 --> 08:04.380
I know this was a
long in-depth talk,

08:04.380 --> 08:06.180
but if there's something
that I didn't cover,

08:06.180 --> 08:07.640
or there's something that you

08:07.640 --> 08:09.500
want more information about,

08:09.500 --> 08:12.050
please feel free to let us know.

08:12.050 --> 08:14.260
Again, I hope you
enjoyed the video.

08:14.260 --> 08:15.830
Thanks for watching and again,

08:15.830 --> 08:20.280
come back to Cybrary for
more exciting classes.