Front Cover

Insider Threat

Copyright Page

Contents

About Deloitte

About the Author

Foreword

Acknowledgments

1 Introduction – Insider Threat Today

Introduction

Looking Ahead

This Book

What is Insider Threat?

What Motivates an Insider to Act?

Environmental Drivers

“Bricks and Mortar” to “Bits and Bytes”

The Virtual Space

Exfiltration Points

Technology and the Insider Threat

Changing Workplace Demographics

Social Media and Validation:

A Technical Workforce:

Expectations of Ownership:

Limited Control:

Challenges Managing Information:

Information Mobility

Detecting the Insider Threat

Patterns of Behavior

Mitigating Asset Loss: An Integrated Approach

Defining Critical Assets

Detection

Developing a Secure Workforce

Establishing a Workforce Culture to Mitigate Risk

Top 10 Tips for Leaders

1 Define The Insider Threats

2 Define Your Risk Appetite

3 Optimize a Broad Set of Stakeholders

4 Don’t Forget the Fundamentals

5 Trust but Verify

6 Look for Precursors

7 Connect the Dots

8 Stay a Step Ahead

9 Set Behavioral Expectations

10 One Size Does Not Fit All

In Summary

Key Takeaways

2 Common Challenges to Maturing an Insider Threat Program

Introduction

Challenges Faced by Program Managers

Are There More Insider Threat Cases Now Than There Have Been in the Past?

How Does an Organization Define Insider Threat?

Why Do Insider Threat Programs Need to Look Beyond the Malicious Insider?

Why Are Insider Threat Related Policies and Training Important?

What Capabilities Differentiate an Industry-Leading Insider Threat Program?

How Do I Escalate and Triage Potential Threats Identified by the Program?

How Do I Position an Insider Threat Program to My Workforce?

How Do I Scale My Insider Threat Program?

What are the Skillsets a Leading Program Needs to Have?

What Data are Needed to Proactively Identify Potential Insiders?

How Do I Evaluate and Select an Advanced Analytics Tool?

What Challenges are Generally Encountered When Standing Up a Program?

How Mature Does My Program Have to Be?

How do You Measure the Return on Investment?

Key Metrics

A Global Perspective

Key Takeaways

3 From Bricks and Mortar to Bits and Bytes

The Transformation from Bricks and Mortar to Bits and Bytes

Insider Threat in a World of Bricks and Mortar

Transitional Phase

Insider Threat in a World of Bits and Bytes

Same Behavior, Different Context

Is Insider Activity More Prevalent Now?

The Workforce in a World of Bits and Bytes

Mitigating the Insider Threat in the World of Bits and Bytes

The Insider Threat of Bits and Bytes: A Case Study

Key Takeaways

4 Identifying Functional Ownership

Introduction

Program Location

Executive Support

Independence

Collaboration

Developing a Program to Prevent, Detect, and Respond Framework

Program Ownership

Functional Assessment in Choosing a Program Owner

Program Design

Strategic Framework

Program Assumptions

Program Guiding Principles

Four Program Pillars

Governance Structure and Roles and Responsibilities

Governance Structure

Program Communication and Change Management Plan

Incident Response Process

Ongoing Updates and Process Improvements

Key Challenges

Key Takeaways

5 Identifying Critical Indicators in Organizational Data

Potential Risk Indicators

Contextual Indicators

Virtual Indicators

Nonvirtual Indicators

Translating Knowledge about Insiders Into Organizational Data

Identifying Critical Indicators Throughout the Organization

Key Challenges

Key Takeaways

6 Establishing an Organizational Risk Appetite

Risk Tolerance Defined

Gathering Key Stakeholders a Critical First Step in Defining and Prioritizing Risk Tolerance

Defining Your Organization’s Critical Assets

Determining the Threat Insiders Pose to Your Critical Assets

Balancing Security Investments and Tolerance for Loss

Re-evaluating Asset Prioritization

In Summary

Case Study 1: Financial Services Firm

Case Study 2: Health Care Provider

Case Study 3: Telecommunications, Media, and Technology

Key Takeaways

7 Risk Management Using Data Analytics

Introduction to Advanced Analytics

Growing Consensus

Guiding Principles

Advanced Analytics in Motion

Use Case

The Solution

Visualization

Advantages

Selecting the Right Tool

Business Rule Approach and Development

Advanced Analytics Security

Security Analytics as a Business Enabler

Aggregate Data to Enhance Productivity

Policy Enhancements

Business Processes Enhancements

Key Takeaways

8 Information Security and Technology Integration

Introduction

Administrative and Procedural Controls

Improving the IT Culture Through Administrative Controls

Building-In Versus Bolting-On

Training

Technical Controls

Identity and Access Management

User Activity Monitoring (UAM)

Physical Controls

Preventive Physical Controls

Detective Physical Controls

Future of Security Controls

Conclusion

Key Takeaways

9 Robust Cyber Risk Management

Cyber Risk Management and Business Performance

Robust Mindsets: Secure, Vigilant, Resilient

Secure

Vigilant

Resilient

Insider Threat: A Dynamic, Multilevel Problem

Building Robust Mental Models and Collective Mindsets

Common Characteristics: Secure, Vigilant, Resilient Programs

Key Takeaways

10 Threats Posed by Third-Party Insiders: Considerations for a Vendor Vetting Program

Introduction

Trends Driving Prevalence of Vendors in the U.S. Market

Examples of Threats Posed by Vendors

Information Breach

Workplace Violence

Commercial Cover

Supply Chain Infiltration

Unethical Sourcing

In Summary

Vendor Vetting Defined

Approach to Vendor Vetting

Basic: Level 1

Intermediate: Level 2

Advanced: Level 3

In-Depth: Level 4

Automated Vendor Vetting Solutions

Key Takeaways

11 Employee Engagement: Critical to Mitigating the Risk of Insider Threat

Introduction

Understanding Why Employee Engagement is a Critical Issue

Engagement is a Critical Workforce Challenge Today

Workplace Drivers of Engagement

Measuring Employee Engagement

Improving and Sustaining Engagement

Key Takeaways

12 Workplace Violence and Insider Threat

Introduction

A Historical but Cumulative View of Workplace Violence and Insider Threat

Key Concepts

Myths Regarding Workplace Violence

Warning Signs

Key Takeaways

13 Monitoring and Investigating

Monitoring

Prioritizing a Monitoring Capability

Baseline Behavior

Communication

Escalation and Triage Process

Continuous Improvement

Responding to an Insider Threat

Response Team and Process

Conducting a Review: Escalation and Triage

What Escalation and Triage Looks Like

Results of an Inquiry

Key Takeaways

14 Privacy Considerations for Insider Threat Mitigation Programs

Introduction

Data Privacy and the Collection of Potential Risk Indicators (PRIs)

Balancing Data Privacy with Effective Insider Threat Mitigation

The Privacy Impact Assessment (PIA)

Determining the Need for a PIA

Conducting the PIA

Additional Privacy Considerations

Conclusion

Key Takeaways

15 What the Future Holds

Insider Threat: A Look Forward

The Changing Definition of Insider

Understanding the Macro Environment

Impact of Economic Downturns

Privacy Expectations

Policy Implications

Emerging Trends

Targeting Employees

Protecting the Entire Value-Chain

The Virtual Environment

Big Data and Risk Analytics

Scenario Planning

Scenario 1.0: Nearsighted/Farsighted

Scenario 2.0: Selective Views

Scenario 3.0: Unreconciled Perspectives

Scenario 4.0: 20/20 Vision

What’s Next?

Appendices

Chapter 5

Appendix G: Business Assurance/ Insider Threat Working Group Charter

Introduction

Phase I Project Background

Phase II Project Objectives

Roles and Responsibilities

Membership

Authority

Communication

Appendix I: Business Rule Development

Appendix L: FAQs

Pilot Questions

Index

Back Cover