The Insider Threat Podcast

*/ ?>

View Top 200 Chart

Back to Rankings Page

Technology
**The Insider Threat Podcast**

This is a podcast where we explore the issues today with the insider threat, or human factor, of our organizations. We also talk about ways to tackle those issues through training, culture, and technology in order to help information security and business professionals reduce risks in their environments.

We have a patreon page for the podcast, located at . I don’t want to be too pushy for this, but a couple of you have asked about ways that you can support the show.

Latest Episodes:

Episode 47 - Phishing for Hire and Security Culture Feb 28, 2019

Show notes

*Title - Phishing for Hire and Security Culture *

Intro

Welcome back! This is episode 47 of The Insider Threat podcast. I know we have had some crazy things going on with the website lately. Our hosting provider changed some things and we are still working that out. It shouldn’t stop you from being able to get the episodes in your favorite podcast app though. Or at least I hope.

Some really good news that I haven’t had the opportunity to share on here is that the first version of the insider threat protection framework has been released! It was a long time coming and I think it is a good starter document for helping organization in their quest to improve their insider threat programs. Check it out by going to the link in the show notes or shooting me an email and be sure to let me know what you think about it!

I understand that it has been a while since I’ve posted an episode and I’m sorry about that. For those who don’t know me personally or follow me on LinkedIn, I just started a new position and things have been crazy. I really miss my old team and the people who we got to serve. That leads us right into the main topic for this episode though, because my primary focus in my last position was improving security culture and we did exactly that. Before we get into that, though…

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “On December 10th 1993, id Software released a product that was used by approximately 15-20 million people and greatly influenced similar products even until today. What was the name of this product?”

The answer was “Doom”.

Do you guys remember this game? I’ll never forget it as long as I live and I couldn’t even make a guess at how many hours I sank into that game. Thinking back though and comparing it to today, I don’t think I’d feel comfortable allowing my kids to play Doom. This doesn’t have anything to do with my parents - just that times and society have changed since then.

Congratulations to:

Skye from Texas, Ben from New Town, Pete from Atlanta, and Marcus from Michigan for getting the correct answer.

Here’s your question for this episode: “This week in 1998, Apple decided to discontinue one of their operating systems and its associated product, leaving only the Macintosh computer in their product line until the iPod was released. What was the name of the operating system and name one of the devices that used it.”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “Apple”.

Discussion Topic for the Episode

This episode’s discussion topic is security culture, but more related to the benefits and disadvantages of running phishing campaigns against your organization.

I’ve seen several people and organizations that hear about others who have strong security cultures and they immediately look for ways to improve their own. What is one of the first things that come up when they google the topic? Phishing services.

There is a major problem with going this route off the bat, especially if you believe that simply phishing your employees will increase the security culture in your organization. You’ve got your IT Security department trying to trick them into getting into trouble and you’re probably worse off than where you were to begin with.

I’m not at all saying that phishing services and technologies don’t have a place in security culture, though. It can be one way to measure the progress of your improvement efforts. That’s the key thing though - phishing your employees is not an effective improvement effort. It’s just a method of measuring.

Good ways to improve your culture have been mentioned in other episodes, but for the most part you can see an impact if you increase communication, have public senior management support, and bring it home. What I mean by that is to play on people’s emotional connection to the people they care about. If you give them tips to keep their families safe, the message resonates much better. Personally, I’ve seen great success using this route with my last employer. We increased reporting by 1500% each month, which is another way of saying we went from 0 reports to around 15.

Speaking of reporting, that is another way to measure the effectiveness of your security culture improvement efforts. If you want more information on all this, check out the insider threat protection framework at the link at the bottom of the show notes.

And let me know what you think!

Closing Thought

Our closing thought for this episode comes from Charlie Munger, the semi-silent parter of Warren Buffet. He said, “The best thing a human being can do is to help another human being know more.”

Outro

Thank you for listening to this episode of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

You can contact me on twitter @stevehigdon or send an email to steve@theinsiderthreatpodcast.com. Go to our website, www.theinsiderthreatpodcast.com, to find the show notes for this and every other episode, as well as links to the topics we’ve covered. You can also go to the website to find a link to the Patreon page and subscribe to the newsletter to get up-to-date information on current episodes and news for the show. Call and leave a voicemail at (443) 292-2287 to have a conversation, get a comment added to the show, or even ask a question.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Insider Threat Protection Framework - https://archive.org/download/InsiderThreatProtectionFramework2018/ITPF_2018.pdf

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Links

Insider Threat Protection Framework

Episode 46 - The Importance of Risk Dec 17, 2018

Show notes

*Title - The Importance of Risk *

In this episode we cover risk, an update on the framework, no real insider threat news, and more. Don’t touch that dial!

Intro

Welcome back! This is episode 46 of The Insider Threat podcast, for the week of December 17th, 2018.

Update on the framework
I am about at 98% for the framework and it will be going out this month. I’ve had help from several of you, as well as other industry titans who really care about helping organizations to address the problem. I’ll be forever in your debt with this.
Happy holidays to everyone around the world, no matter what holidays you recognize.

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In November of 1980, Microsoft was approached by IBM to supply an operating system for the PC that IBM had in development. Microsoft was able to get it done, but they did not come up with the operating system themselves. Where did they get it and what was it called?”

The answer was “Tim Paterson and 86-DOS”.

I’m not sure if you all have seen Pirates of Silicon Valley, but essentially Microsoft made the deal with IBM claiming they had an operating system before they actually did. They depended on Paterson’s 86-DOS (which was later called IBM PC-DOS and MS-DOS) to deliver and they bought it for less than $100K.

Congratulations to:

Alvaro from Virginia, Jim from Kansas City, Charlene from Texas, and Rick from Quebec for getting the correct answer.

Here’s your question for this episode: “On December 10th, 1993, id Software released a product that was used by approximately 15-20 million people and greatly influenced similar products even until today. What was the name of this software product?”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “space marine”.

Discussion Topic for the Episode

This episode’s discussion topic is risk

Risk is one of the most important aspects of everything we do, especially in information security. We assess it every time we drive somewhere or cross the street and it drives everything in business.
As information security professionals, we have a very specific idea of what risk is, but I think it is useful to understand it from a more broad perspective and learn how we can use it to shape our efforts.
There are several equations used to measure risk, but the most common one is impact multiplied by probability (or likelihood). In information security, we often say threat multiplied by vulnerability. If you really look at it, those mean almost the same thing.
We often get hung up on CVSS rankings attached to vulnerabilities, but those don’t take into account our specific and unique environments.
Let’s take a patch, for example. We might know that a specific patch fixes a vulnerability that provides remote access to a system or application. That sounds pretty bad and would have a high CVSS score
Now what if mitigating that vulnerability took a long time and cost a lot of money? What if it only applied to an air-gapped system in your environment that wasn’t used for a key business function? The risk level should be significantly lower for something like that.
We often don’t account for business risk when thinking about information security risk. I’ll let you in on a secret - they’re the same thing.
Before we start running around and flapping our arms about something, we need to figure out if it will really have a negative impact on the key business functions and information of our organizations. After all, that’s what we are actually charged to protect.
I recommend starting there. Figure out what is most important for your organization’s operation. What data or capabilities are absolutely essential? How can we focus our information security efforts to protect those?
The same goes for insider threat, and in several ways these go hand-in-hand. What of those key functions, capabilities, data, and people cause the greatest concern? How can you mitigate that risk?
When dealing with people, you have to look much further than just buying some sort of product and hoping it will solve the problem. We have gone into great detail when discussing those areas in the past and it is a huge focus of the framework.

News

I don’t have any news for you this episode. Everything that came into my feed was either about the Tesla employee or marketing messages from organizations trying to sell products that claim to completely fix insider threat.

Closing Thought

Our closing thought for this episode comes from Jimmy Dean. He said, “I can’t change the direction of the wind, but I can adjust my sails to always reach my distination.”

Outro

Thank you for listening to episode 46 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 45 - Why are we here? Nov 12, 2018

Show notes

Intro

Welcome back! This is episode 45 of The Insider Threat podcast, for the week of November 12th, 2018.

Update on the framework
Mention Re-Thinking the Human Factor Podcast and Book by Bruce Hallas

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “On October 10th, 1980, a company called Midway released the first true mega-hit video game in history. What was the name of this game?”

The answer was “Pacman”.

We’ve seen several video games hit it big in the last several decades, but Pacman is still one that even younger people can associate with (or at least they’ve heard of it). Some would argue though that Mrs. Pacman was the better game of the two.

Congratulations to:

Xavier from Canada, Marco from Bondville, and Brigitte from Bilingshurst for getting the correct answer.

Here’s your question for this episode: “In November of 1980, Microsoft was approached by IBM to supply an operating system for the PC that IBM had in development. Microsoft was able to get it done, but they did not come up with the operating system themselves. Where did they get it and what was it called?"”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “Dirty”.

Discussion Topic for the Episode

This episode’s discussion topic is just an overview of what it means to be in this industry.

I’ve been thinking about this quite a bit recently, trying to figure out why I am in this field and why I have an affinity for insider threat
Some people are into the technology, some are into compliance or auditing, some are just really good technical writers
What I’ve come up with: We like to help people and businesses improve
Probably a general statement, but when I was at BSidesDC a few weekends ago, that really is the feeling that I got from the community
Am I wrong in this? Is there something else that drives you to get up in the morning and get to work?
LET ME KNOW!

News

The US Goverment released an insider threat program maturity framework

What with this do to the framework that we are developing?
Focus of this framework vs. the insider threat protection framework
Still good information

https://www.dni.gov/files/NCSC/documents/nittf/20181024NITTFMaturityFramework_web.pdf

It looks like people are still attempting to sue the government over the OPM hack from 2014

According to the article, the judge hearing the appeals case claims that it will be difficult for the government to prove that the victims of the breach don’t have standing to sue.
Not many people are successful in suing the US Government, so it will be interesting to see where this one goes.

https://www.govexec.com/pay-benefits/2018/11/judge-says-govt-faces-uphill-battle-prove-opm-hack-victims-dont-have-standing-sue/

Closing Thought

Our closing thought for this episode comes from Bill Gates. He said, “It’s fine to celebrate success but it is more important to heed the lessons of failure.”

Outro

Thank you for listening to episode 45 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 44 - Cybersecurity Awareness Month! (and Facebook) Oct 22, 2018

Show notes

Intro

Welcome back! This is episode 44 of The Insider Threat podcast, for the week of October 22nd, 2018.

Everything has been busy!
The weather is finally cooling down
It is close to the end of the month. What have you done for Cybersecurity Awareness Month?
Update on the framework

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In 1998, US Congress approved the release of a famous report on the internet. This caused several websites to crash, due to extremely high traffic volume. What was this report?”

The answer was “the investigation report of President Bill Clinton’s impeachement”.

I’ve actually read this and it really opened my eyes to the true story, or at least what was found during the investigation.

Congratulations to:

Thomas from Alachua, Neil from Ottowa, and Ruby from Indiana for getting the correct answer.

Here’s your question for this episode: “On October 10th, 1980, a company called Midway released the first true mega-hit video game in history. What was the name of this game?”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “fever”.

Discussion Topic for the Episode

This episode’s discussion topic is a list of ideas for cybersecurity awareness month

Here we are, a few weeks into Cybersecurity Awareness Month
You may be wondering what you can do to capitalize on this time to improve your organization
First, be intentional and communicate those intentions
Develop a list of initiatives for the month, at least one thing weekly
Articles or newsletters
Create and/or share short training videos (shorter is better)
Hold brown bag training events
Bring it home
Record 5-10 minute audio files to share
Don’t stop on November 1st (this would be just as bad as only having annual training)

News

Facebook breach

https://ctovision.com/facebook-data-breach-4-simple-steps-to-stay-safer-right-now/

Was it 50 million? 29 million? Who knows.
Bottom line is that many Facebook user accounts were compromised.
So far the biggest impact I’ve seen is that people are getting friend requests from people they are already friends with (cloned accounts)
I’ve provided a link to some things you can do to stay safe, but the main thing is to change your password.

Closing Thought

Our closing thought for this episode comes from Steve Jobs. He said, “Your work is going to fill a large part of your life, and the only way to be truly satisfied is to do what you believe is great work. And the only way to do great work is to love what you do. If you haven’t found it yet, keep looking. Don’t settle. As with all matters of the heart, you’ll know when you find it.”

Outro

Thank you for listening to episode 44 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443)292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 43 - Learning the Hard Way Sep 17, 2018

Show notes

*Title - Learning the Hard Way *

In this episode we cover some lessons we’ve learned in the course of our work, some insider threat news, and more. Don’t touch that dial!

Intro

Welcome back! This is episode 43 of The Insider Threat podcast, for the week of September 17th, 2018.

How has everyone’s summer been? We’ve had several trips to visit family members and I am working on something that I’m very excited about. Many of you share my concern about the message that is spread about insider threat in that all we hear about from news media and vendors are the malicious insiders. We hear about breaches caused by insider threat all the time (mainly phishing), but they almost never tell the story about how it happened to begin with.

To help you all, I am developing an Insider Threat Protection Framework. What I am doing is concentrating on the four pillars that we have spoken about several times and I’m identifying specific controls that we can implement to help strengthen those key areas - policy, technology, training, and culture. That said, I’m not doing this alone. I am bouncing ideas for the controls off people in my network for sanity checks and they are offering great ideas as far as additional controls that I should include.

When will this be done? I have no idea. I’ve just now finished drafting the policy controls, so I still have a way to go. That said, if you would like me to send you an early copy of the framework as soon as it is finished, please shoot an email to steve@theinsiderthreatpodcast.com and I’ll not only send you the final version, but I’ll keep you up to date on the progress as it’s made. By the way, I have absolutely no plans on selling the framework or anything like that. This is just another passion project for me, just like this podcast.

Again, I am very excited to see where this goes.

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In August of 2006, Dell recalled approximately 1.4 million computer batteries, which was the biggest computer-related recall in history. What was the cause of the recall?”

The answer was “that the batteries overheated and some actually caught fire or exploded”.

When you think of the fact that these were laptops, overheating or even exploding batteries are a serious issue. How would you like to be sitting there trying to get work done and all of the sudden your lap is on fire?

Congratulations to Brayden from Lounton, Frank from New Hampshire, Arthur from Toronto, and Missy from Chicago for getting the correct answer.

Here’s your question for this episode: “In 1998, US Congress approved the release of a famous report on the internet. This caused several websites to crash, due to extremely high traffic volume. What was this report?”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “truelove”.

Discussion Topic for the Episode

This episode’s discussion topic is lessons learned from being in information security.

A few years ago, I was a consultant for a company where someone accidentally reverted an SQL server back to a previous snapshot, which caused several weeks of data to be lost. The type of data we’re talking about here is tracking information for all the employees in the organization and their IT equipment. They also lost information for record processing that the company was legally obligated to maintain. What about backups? Well, they did do backups of the database and even tested those backups, but they were stored on the same server. When that server was rolled back to an earlier snapshot, the backups were gone as well. It took weeks to rebuild the data - what could be rebuilt, anyway. In the end, managers from several departments were calling for my head as the resident expert, as well as several other people who were involved. I kept my job, which was great, but the greatest things of the entire situation were the lessons that we all learned.
First, everyone makes mistakes. Some make bigger mistakes more often than others, but none of us are blameless. The important thing, and I feel like I’m talking to my kids here, is that we learn from those mistakes. We changed our backup processes so that backups were stored on different servers in multiple locations and we tightened both our backup and patching procedures. We also increased training in those areas to reduce the likelihood of similar mistakes happening in the future.
For another story, I received a call from an employee three years ago stating that something very strange was happenening on ther computer and she was really worried about it. This employee fell prey to a phishing campaign with her previous employer, which led to stolen data for that organization. She wasn’t going to let it happen again. While she may have learned the hard way about reporting things to the information security department, the point here is that the lesson was learned. She, and all of our employees, are teachable.
Both of these true examples are cases where non-malicious insider threats were involved in incidents that caused great negative impact to their organizations. It is important to remember that we can’t completely reduce the risks associated with insider threat, even if we apply all the things that we talk about on this podcast. Mistakes will continue to happen. The important thing is that we learn from the actions or inactions of ourselves and others to continuously improve our own methods for building and maintaining the security posture of our organizations and all those we come in contact with.
Between 1956 and 1971, Tom Watson Jr. was the CEO of IBM. At one point, a young executive made some bad decisions that ended up costing the company millions of dollars. This executive went to Tom and said something to the tune of “I suppose after that set of mistakes you will want to fire me.” To this, Watson said, “Not at all, young man, we have just spent a couple of million dollars educating you.”
Continue to think about the lessons that can be learned about anything you experience and use those to improve yourself and your organization.

News

Imperva did a survey and found that at least half of information security respondants claimed that they could carry out an insider attack if they wanted to.

https://www.imperva.com/blog/2018/08/report-nearly-half-of-security-professionals-think-they-could-execute-a-successful-insider-attack-on-their-organization/

This one has been floated around quite a bit lately, but I refuse to get as excited about it as others. It is similar to saying that a building inspector could cause a building to fall down. Of course they can. We are talking about folks that likely have administrative rights to the system, know the protection mechanisms, and know when and how alerts are generated. For me, this just seemed like it was blowing a bunch of hot air for no reason at all, and certainly not actionable statistics (if you ever consider these surveys to be able to generate actionable statistics).

Fired worker hacked into former employer’s emails and changed password

https://www.gazettelive.co.uk/news/teesside-news/fired-worker-hacked-former-employers-15125259

Anthony Leung was convicted for hacking into the network of his previous company, changing the email passwords for multiple executives, and then accessing their email. During the court case, the accused stated that he didn’t have the technical skills necessary to commit the offense. The only evidence for this case were the logs of the email server showing that someone external had accessed the accounts and fragments of company emails on Mr. Leung’s computer. Police first suspected him when they found a copy of his resume in a strange folder in one executive’s inbox.
What do I think happened? He probably just called the helpdesk and got the passwords changed to something temporary - which is common practice for organizations. I wouldn’t be surprised in this case if he still had access to company networks, either. We really need to make sure that we are disabling accounts for people who are leaving the organization.

Listener Feeback

I received some feedback recently, but it was about the website. Someone asked why I hadn’t installed SSL certificates and they were absolutely correct. I’ve been trying to work with my podcast hosting provider for over a year to implement this capability, but I was finally forced to make all traffic redirect to another solution, which allowed me to encrypt the traffic. That said, nobody is really inputing or storing data on the website except maybe your email address, but in any case if you go to theinsiderthreatpodcast.com it should redirrect to https now.

Closing Thought

Our closing thought for this episode comes from John Wooden, because I am reading one of his books on leadership right now called “Essential Wooden”. He said, “Success is peace of mind which is a direct result of self-satisfaction in knowing you did your best to become the best that you are capable of becoming.”

Outro

Thank you for listening to episode 43 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 42 - Different Types of Insider Threat Aug 20, 2018

Show notes

Intro

Welcome back! This is episode 42 of The Insider Threat podcast, for the week of August 20th, 2018.

Not going to hacker summer camp this year. Hope to catch up with you all later in the year at conferences in the DC area.

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In July of 1995 IBM bought spreadsheet and word processing software in order to challenge Microsoft’s Office suite. What were the names of these products?”

The answer was “Ami Pro and 1-2-3”.

I don’t really have any commentary about this one, but it is interesting to go back and research the evolution of commonplace office applications. If you get some time, look up Dan Bricklin, who was essentially the father of the modern day spreadsheet. He was always humble about his creation, saying that it’s something that anyone could have done.

Congratulations to Spenser from Boyle, Sophie from Denton, Liam from San Antonio, and Ralph from Atlanta for getting the correct answer.

Here’s your question for this episode: “In August of 2006, Dell recalled approximately 1.4 million computer batteries, which was the biggest computer-related recall in history. What was the cause of the recall?”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “caliente”.

Discussion Topic for the Episode

This episode’s discussion topic is the difference between different types of insider threat programs

The primary types of insider threat programs I want to highlight are DoD/Federal, corporate, and personal
Due to the Snowden and Manning affairs, the federal government is more concerned with traditional data loss prevention concerns
Almost completely focused on malicious users and data exfiltration
Outside of the government, we are concerned about negligent and accidental insiders as well
What strategy works best for your organization?
It depends on the controls you have in place for non-malicious insiders
Government strips or disables links in emails, tags messages from external sources

News

UnityPoint phishing caused loss of medial information for 1.4 million patients

https://www.desmoinesregister.com/story/news/health/2018/07/30/unitypoint-data-breach-million-patients-email-hack-hacked-phishing-e-mail-health-care-iowa/866760002/

One of Iowa’s main hospital and clinic systems has notified about 1.4 million patients that their personal information might have been breached.

UnityPoint Health officials said hackers used “phishing” techniques to break into the company’s email system. The company, based in West Des Moines, said the hackers could have obtained medical information, such as diagnoses and types of care, that was included in emails.

https://www.fbi.gov/contact-us/field-offices/portland/news/press-releases/fbi-tech-tuesday-building-a-digital-defense-against-facebook-messenger-frauds

FBI warns of more scams and phishing attempts coming from messaging features on social media
Fraudsters or attackers will “hack” social media accounts and send phishing emails to everyone on their friends list
These are especially tricky, as they will be coming from “legitimate” sources

https://abc11-com.cdn.ampproject.org/c/s/abc11.com/amp/cree-employee-charged-with-stealing-company-secrets-worth-more-than-$100m/3900002/

An employee of a worldwide company based in Research Triangle Park is accused of stealing thousands of documents full of sensitive information and intellectual property worth more than $100 million
Coy Bell, 47, is charged with larceny by employee, and allegedly stole those secrets from his employer, Cree, Inc. The company is publicly traded on NASDAQ and is known for being a market-leading innovator in LED lighting.
Further investigation found surveillance video showing Bell “holding a small object” like an SD card and inserting it into his computer.
A Durham County search warrant states Bell could have given the files to “a competitor or foreign entity.”
Deputies seized his phone and sought access to at least one dozen other related items.
Bell was arrested on June 18. He was released after posting a $150,000 secured bond.
Interesting is how they found out: another employee saw the SD card on the sidewalk outside the building and the IT team was able to determine that it came from Coy’s company computer
Bad luck for Coy, but really good luck for Cree

Closing Thought

Our closing thought for this episode comes from the Queen of Soul and recently departed music legend, Aretha Franklin. She said, “Be your own artist, and always be confident in what you’re doing. If you’re not going to be confident, you might as well not be doing it.”

Outro

Thank you for listening to episode 42 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 41 - Emerging Technologies in Insider Threat Jul 23, 2018

Show notes

Intro

Welcome back! This is episode 41 of The Insider Threat podcast.

New Idea Probably won’t work for everyone Weekly podcast for my organization Will cover both IT topic of the day and infosec Noticed employees love information and are always on the road
Books Phoenix Project, The Goal, Atlas Shrugged
Next Not sure. Catching up on podcasts.

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In July of 1953, the first mass-produced computer was announced by IBM. This computer ended up becoming the dominant computer of the decade. What was the model of this computer?”

The answer was “IBM 650”.

The hashtag from last week, “10-digit-memory”, was actually a big clue. It is amazing to think of where we are now as far as computers go, since the memory of the IBM 650 was so small.

Congratulations to: Dirk from Kannapolis, Simone from Kentucky, John from Kentmere, and Daniel from Washington for getting the correct answer.

Here’s your question for this episode: “Speaking of IBM, In July of 1995 IBM bought spreadsheet and word processing software in order to challenge Microsoft’s Office suite. What were the names of these products?”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “jotting down some numbers”.

Discussion Topic for the Episode

This episode’s discussion topic is emerging technologies in insider threat

Up and coming technology

Votiro - document protection

Menlo* - isolation technology (Greg Maudsley)

ObserveIt* - UEBA

Ninjio* - training

Viewfinity - Privilege management

Canary Tokens* - Detecting the breach

News

Theft of Apple Self-Driving Car Data

https://securityboulevard.com/2018/07/monday-july-16-dtex-insider-threat-news-privileged-user-dents-apple-self-driving-car-program-doj-says-russia-hacked-clinton-campaign-issues-indictments-against-spies/

Last week, Apple found out it had an insider threat active in its ranks. It was the type of insider that Dtex and the industry commonly refers to as a “leaver.” In this case, the leaver also happened to be a privileged user. A leaver is someone who conducts malicious activities prior to resigning. A privileged user is someone who has special access to specific systems and data. The combination, as Apple discovered, can be a recipe for disaster.

After the leaver, a former employee by the name of Xiaolang Zhang, informed Apple that he was planning to depart the company to take a job with China-based electric vehicle startup XMotors, Apple started looking into his past digital and physical behaviors. After growing suspicious due to activities it observed, Apple notified the FBI. The FBI investigated and then charged Zhang with the crime of stealing trade secrets about Apple’s self-driving car program from the company.

There are a few top takeaways that anyone with a stake in protecting data and IP should be paying attention to. This situation shows: 1) Understanding behaviors is key to knowing whether or not someone is planning to leave a company; 2) It is important to have forensics tools that can piece together what’s happened after the fact; 3) It is equally important to have the ability to receive alerts in real time when bad behaviors are in play.

I hate that we are always talking about malicious insiders, but those are the only ones that make the news.

Closing Thought

Our closing thought for this episode comes from Ayn Rand, author of many books, to include Atlas Shrugged, which I just finished reading. She said, “What greater wealth is there than to own your life and to spend it on growing? Every living thing must grow. It can’t stand still. It must grow or perish.”

Outro

Thank you for listening to episode 41 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 40 - Overcoming Resistance to Insider Threat Changes Jul 02, 2018

Show notes

Title - Overcoming Resistance for Insider Threat Change

Intro

Welcome back! This is episode 40 of The Insider Threat podcast, for the week of July 2nd, 2018.

July 4th and Canada Day

World Cup - I picked Germany. My 9 year old will probably win.

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In 1996, the term ‘phishing’ was introduced in a Usenet group that was focused on America Online. What was the name of this group?”

The answer was “AOHell”.

There is speculation that the reason phishing starts with “ph” instead of “f” is due to the earlier spelling of phone phreaking, which uses the same spelling substitution. America Online at the time was one-stop-shop for early social engineering exploits.

Congratulations to:

Swen from Lac Au Saumon, Patrick from Virginia, Lola from Santa Fe Springs, and Brodie from Quebec for getting the correct answer.

Here’s your question for this episode: “In July of 1953, the first mass-produced computer was announced by IBM. This computer ended up becoming the dominant computer of the decade. What was the model of this computer?”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “10-digit-memory”.

Discussion Topic for the Episode

This episode’s discussion topic is resistance to insider threat program changes and how to overcome them

Trying to be a hero, but you are running into roadblocks by either management or employees
Management – Funding – Process change
Employees – Perceived prod impacts – Feeling of no trust
Solution – Include senior management at the beginning. You can’t ask them to change production processes suddenly and without warning. – Have open dialog with employees. Explain to them why things are important. That is a very important part of your program, anyway.

News

Tesla

Link - https://www.infosecurity-magazine.com/news/teslas-tough-lesson-on-malicious/

According to a supposed email from Elon Musk to Tesla employees, someone committed sabotage against the company that included the use of false usernames to make changes to the code used in the Tesla Manufacturing Operation System, as well as “exporting large amounts of highly sensitive Tesla data to unknown third parties.”
This all supposedly happened because an employee didn’t get the promotion he was going for.
While this will certainly be used by vendors to sell User and Entity Behavior Analytics, Identity and Access Management, and similar products, we have to remind ourselves that malicious insider threat only really accounts for less than 10% of insider threat incidents.
I agree though, that those types of tools would go a long way in twarting these types of attacks.

Exactis

Link - http://www.dailymail.co.uk/sciencetech/article-5900071/Marketing-firm-Exactis-leaks-340-million-files-containing-private-data.html

Whether it is 230 million or 340 million people whose data was left unprotected (sometimes I think they just spit ball these numbers), it is still a very big deal.
This is bigger than Equifax, and includes home addresses, phone numbers, email addresses and other sensitive information for named individuals. They also record their hobbies, interests and habits, as well as the number, age, and gender of any children they have.
The data is now secured and the FBI is investigating.
There is currently no way to see if your data was included or if anyone downloaded a copy.

Links to both of these stories are in the show notes.

Closing Thought

Our closing thought for this episode comes from Elon Musk. He said, “When something is important enough, you do it even if the odds are not in your favor.”

Outro

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Notes

*Title - Overcoming Resistance for Insider Threat Change *

In this episode we cover some common issues with implementing insider threat programs and how to deal with them, Tesla and Exactis (should you be worried?) and more. Don’t touch that dial!

Intro

Welcome back! This is episode 40 of The Insider Threat podcast, for the week of July 2nd, 2018.

July 4th and Canada Day

World Cup - I picked Germany. My 9 year old will probably win.

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In 1996, the term ‘phishing’ was introduced in a Usenet group that was focused on America Online. What was the name of this group?”

The answer was “AOHell”.

Congratulations to:

Swen from Lac Au Saumon, Patrick from Virginia, Lola from Santa Fe Springs, and Brodie from Quebec for getting the correct answer.

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “10-digit-memory”.

Discussion Topic for the Episode

This episode’s discussion topic is resistance to insider threat program changes and how to overcome them

Trying to be a hero, but you are running into roadblocks by either management or employees
Management – Funding – Process change
Employees – Perceived prod impacts – Feeling of no trust
Solution – Include senior management at the beginning. You can’t ask them to change production processes suddenly and without warning. – Have open dialog with employees. Explain to them why things are important. That is a very important part of your program, anyway.

News

Tesla

Link - https://www.infosecurity-magazine.com/news/teslas-tough-lesson-on-malicious/

According to a supposed email from Elon Musk to Tesla employees, someone committed sabotage against the company that included the use of false usernames to make changes to the code used in the Tesla Manufacturing Operation System, as well as “exporting large amounts of highly sensitive Tesla data to unknown third parties.”
This all supposedly happened because an employee didn’t get the promotion he was going for.
While this will certainly be used by vendors to sell User and Entity Behavior Analytics, Identity and Access Management, and similar products, we have to remind ourselves that malicious insider threat only really accounts for less than 10% of insider threat incidents.
I agree though, that those types of tools would go a long way in twarting these types of attacks.

Exactis

Link - http://www.dailymail.co.uk/sciencetech/article-5900071/Marketing-firm-Exactis-leaks-340-million-files-containing-private-data.html

Whether it is 230 million or 340 million people whose data was left unprotected (sometimes I think they just spit ball these numbers), it is still a very big deal.
This is bigger than Equifax, and includes home addresses, phone numbers, email addresses and other sensitive information for named individuals. They also record their hobbies, interests and habits, as well as the number, age, and gender of any children they have.
The data is now secured and the FBI is investigating.
There is currently no way to see if your data was included or if anyone downloaded a copy.

Links to both of these stories are in the show notes.

Closing Thought

Our closing thought for this episode comes from Elon Musk. He said, “When something is important enough, you do it even if the odds are not in your favor.”

Outro

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 39 - Victimization of Phishing Jun 11, 2018

Show notes

Introduction

In this episode we cover the victimization of phishing, some insider threat news, and more. Don’t touch that dial!

Welcome back! This is episode 39 of The Insider Threat podcast, for the week of June 4th, 2018.

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “In 2013, someone hacked into the Twitter account of the Associated Press and tweeted about explosions. This caused the DOW to drop 143 points, even though AP employees immediately corrected the disinformation. In this fake news post, where did the explosions take place?”

The answer was “The White House”.

This is just one way that nefarious peole can have a negative impact on industry and society. If you really want to see some interesting things, watch Black Mirror.

Congratulations to: Elizabeth from Nisswa, David from Beaumont, Lily from Victoria, Kelvin from Aimster, and Mollie from Garden City for getting the correct answer.

Here’s your question for this episode: “In 1996, the term ‘phishing’ was introduced in a Usenet group that was focused on America Online. What was the name of this group?"”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “Hades”.

Discussion Topic

The discussion topic for this week is the victimization of phishing.

Both real phishing attacks and internal phishing
Safe to say that if everyone in the organization gets a phishing email, a percentage of employees WILL click on it
Focus training not just on prevention, but response
Encourage reporting, even if they accidentally fall victim
Last thing you want is for people to be afraid to report because they clicked on the link or open the attachment - they are the most important
(I tell my users) I’d rather have 100 false reports every day that I have to weed through than miss that one real one that causes a major breach
Does your organization conduct internal phishing assessments?
Do you hire a vendor to do this, or do you do it yourself?
How can we encourage our people to file reports even after they fall vicitim?
One way that I do this is to personally thank them for their reports, no matter how benign
You can also send out security newsletters to your employees highlighting typical attack vectors and known current techniques
Bottom line - the better your security culture is, the more likely they are to report suspicious activities

News

https://louisianarecord.com/stories/511444395-partco-alleges-fired-employee-hacked-website-email

A complaint filed May 24 in U.S. District Court for the Middle District of Louisiana alleges a recently terminated employee hacked into the company’s website and email system, essentially rendering both unusable; and took client files when she left.

Partco is apparently a machine shop that provides services to the energy sector.

This complaint states that the employee hacked into these systems but from what I’m reading, she was basically in human resources and served as the office manager when it came to safety and compliance. In the world we live in now, where everyone is flapping their arms and claiming that there is such a shortage of skilled tallent in information security, I find it hard to believe that this individual (Ms. Mary Langlois-Templet), actually hacked into anything. I’m not saying she didn’t do it, but the company was in the middle of being acquired and this smells like they just didn’t revoke her access when she left.

I don’t think I need to go into too much detail with the moral of this story, as it is one we have heard before.

Take care of your employees, even when they are being terminated.
For the love of all things holy, disable accounts AS someone separates from the organization.
Reread numbers 1 and 2.

Quote

Our closing thought for this episode comes from American educator, businessman, author, and speaker, Dr. Stephen Covey. He said, “The key is not to prioritize what’s on your schedule, but to schedule your priorities.”

Outro

Thank you for listening to episode 39 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/

Episode 38 - Traveling Protected May 07, 2018

Show notes

Intro

Welcome back! This is episode 38 of The Insider Threat podcast, for the week of May 7th, 2018.

It looks like we are finally done with winter! I heard a few accounts of the RSA conference (comprised mostly of salespeople)

Infosec Trivia Question

It’s time for your Infosec Trivia Question, where Google is king and the prize is nonexistent!

The question last episode was “The term “hacker” originated at MIT where very skilled people programmed in older languages like FORTRAN. When did this take place?”

The answer was “the 1960s”.

I accepted any date within the decade, but most of you simply said 1960s.

Congratulations to: Nick from Tostock, Lucas from Tallahassee, Leo from Kentucky, Lloyd from Buffalo Grove, and Nadine from St. Louis for getting the correct answer.

Here’s your question for this episode: “In 2013, someone hacked into the Twitter account of the Associated Press and tweeted about explosions. This caused the DOW to drop 143 points, even though AP employees immediately corrected the disinformation. In this fake news post, where did the explosions take place?”

Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag “oblong circle”.

Discussion Topic for the Episode

This episode’s discussion topic is some safe tips for traveling

We are getting close to the traveling season, especially as the weather gets warmer
Flying
Consider your destination (both the end point and customs/security)
Pack minimally
Don’t check your devices (especially work laptops)
Review organization’s security policy
Shred your used boarding passes and luggage tags (and don’t take pictures of them)
https://globalnews.ca/news/3927795/airline-boarding-pass-barcodes-can-pose-security-risk-to-passengers-expert/
Use an aircard, if possible
Look out for shoulder surfers
Don’t pick up stray media
Hotels
Take your devices with your or store in the safe
Secure your valuables in your room
Use an aircard or VPN
Keep track of your key card
Hackers have the ability to clone keys or create master keys
https://www.techworm.net/2018/04/finnish-hackers-master-key.html
While you’re away
Consider who will be looking after your house/pets/kids
Secure devices in locked room or safe (physical access trumps all)
Change your passwords
Tell a third party
DON’T POST ON SOCIAL MEDIA!!!
http://money.cnn.com/2017/03/21/technology/laptop-ban-safety/index.html

News

Man hacked into government system in attempt to get his friend released early

https://www.zdnet.com/article/man-who-hacked-jail-systems-to-free-his-friend-joins-him-inside/

“Man hacks into jail and stays for 7 years”
Just proves how pwoerful social engineering can be
Created a fake website that looked and felt like the real thing used by prison employees (failed)
Tweeted the fake website in hopes that employees would click the link (failed)
Called employees, claiming to need help with court records and lure them to the site (failed)
Called employees, claiming to be tech support and lure them to fake websites for “updates” (great success!)
Even got remote login credentials from one employee
Fortunately, the system noticed when he altered prison records and it corrected itself
Also flagged personnel and the FBI was contacted

Closing Thought

Our closing thought for this episode comes from American clergyman Robert H. Schuller. He said, “Never cut a tree down in the wintertime. Never make a negative decision in the low time. Never make your most important decisions when you are in your worst moods. Wait. Be patient. The storm will pass. The spring will come.”

Outro

Thank you for listening to episode 38 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

Thanks again and I’ll see you folks next time!

Contact information:

Call in number: (443) 292-2287

Email - steve@theinsiderthreatpodcast.com

Blog - http://www.stephenhigdon.com

Twitter - https://twitter.com/stevehigdon

LinkedIn - https://www.linkedin.com/in/stevehigdon-infosec/