08 - Hunting the Ghost in the Shell - Case studies of Insider Risk

So, good afternoon, everybody. I'm Don Mallory. I've spoken at BSides a couple of times, but I also run Hack for Kids, which is running alongside BSides Toronto this year for the second third time. And we're going to be talking about insider risk. As usual, the thoughts and opinions shared throughout this presentation are mine and mine alone. They do not represent any of my past, present, or future employers. This does not absolve them of any risk or sorry, it does not absolve me of any risk for this, but it does absolve them. Am I on the right slide? There we go. And just keep in mind that as there's as you go through the presentation, you don't

need to scan any QR codes, but feel free to play along all you like. And who am I? Um I've been in the industry for a long time. I'm over 30 some odd years now and have experience in IT primarily in critical infrastructure. A large portion of that has had a security focus in at some stage or other. And I've helped build and mentor a number of people throughout the industry over the last three decades. Mostly, when it really comes down to it, I'm a parent, student, educator, professional. I have a lot of community engagement and and I like to advocate within community spaces. I'm also in addition to the Hack for Kids, I also co-lead the Hamilton Infosec

meetup. So, if you're ever out in the Hamilton area on the second Monday of any every month, I'm going to advertise for that and I thank BSides for the advertisement. I used to teach black and white darkroom photography, but the darkroom that I actually worked in for the last 20 years shut down this past summer. So, I guess that's the end of that. The end of an era. Unfortunately. So, insider risk versus insider threats. When you're looking at some of these things, it I like to think about the terms in safety officer or protection officer. Uh it's So, you've got these terms that you'll see. Uh if you're looking at something like fire safety or or radiation safety

versus radiation protection or fire protection. They have different goals and different uh intentions. They are not the same thing. A safety officer is someone whose job it is to make people aware of risk. A protection officer is somebody whose job is to actually have an effect on that risk, to be involved in solving those problems. And that comes back very clearly when you start looking into uh information to risk and how you're going to handle insider risks because if we're only talking about risks, they are not the same thing as threats. The The term insider risk that insider threat management with or insider threat was originally a term that came out of the government spaces and military

spaces, and it was primarily around containing uh the potential and enemy combatants.

donors and businesses on the on the business side of things because it sounds a little bit talking about how all of your staff are threats. When it comes right down to it, all of your staff are risks and 100% of your insiders are risks, so 100% of your staff are insider risks. So, what constitutes um an insider? Um how do you define the uh the sources? Where Well, we need to talk about things like people, their accounts, um and the devices that they're using. But that also includes both human and non-human entities. All of those things come together. So, is it a compromised account? Is the compromised account the insider or is that the person who lost the account

that's the insider? It might not be the same thing, but you also have to be very cautious about how you treat your investigations when you're doing those because you might be investigating someone thinking that they're the insider when actually it's a compromised account as opposed to the actual individual. Um what about something like a skimmer or a shimmer? Um are those uh those devices compromised or something that's in in the compromised device supply chain? Um today there are no CPUs manufactured in Canada. Not one. So, how much do we trust our data sovereignty? How much of that is an insider risk? Um is it an actual human human being that we're talking about? Um you know, if

you're thinking about Ghost in the Shell, is it a hacked ghost? Um is it their user account? Uh what about a rogue AI agent? So, understanding these vectors are pretty are are crucial for uh comprehensive insider risk management. Um each requires different detection methods and >> [snorts] >> uh different mitigation strategies. Some of them are behavioral analytics uh for human threats uh or device integrity monitoring or for hardware-based threats. There are two main types of insiders. Um you know, there's un- unintentional and intentional insiders. Who believes in this room that you are not an un- unintentional insider? Anyone? I got one hand. Excellent. Because if you've made a mistake in your organization ever and it had an impact

on your organization, you were an unintentional insider. If you've cost money to the business because of a mistake that you made, you were an unintentional insider. I personally have been an unintentional insider multiple times in my career. Some of those things were just stupid mistakes or I didn't have enough time or I didn't have enough support or I didn't plan well enough. And most of those again come back to lack of planning, lack of time, lack of support and a lack of good management, but that's a different problem. According to the Verizon DBIR as as related to breaches, 81% of those are external actors. The cumulative 19% are internal staff, partners and with access or a

combination thereof. And when we start looking at unintentional or non-malicious, you can break them down into accidental, negligent, mistaken or outsmarted. So this comes down to things like as I noted, careless, rushed, lack of training, no standards, functionality system functionally system systemic issues, a bad boss, a bad company. If you're outsmarted or fished, social engineered or otherwise tricked, now your attack has been your account has been taken over and and it soon will be malicious. The higher the position of the person, the more likely it is that they will be likely to attempt to exfiltrate data. So think about that. The higher the position in the organization, the more likely it is that they will try and get

data out of their organization. Why do they Why do they do that? They have more access. That's part of it, but the bigger one is that when it comes right down to it, they're trying to get their job done and they feel like the technology that's in place is in the way and they just want to be able to to view all of those internal documents on their iPad at home. Or they want to print them out. And so they download them and they print them out at home. That's data exfiltration. That's the That's a risk to the organization. That's insider risk. So, uh That doesn't matter. So, malicious insiders have uh have a fairly direct a much more direct path.

Uh they tend to focus uh they tend to be quieter making detection a lot more difficult as they're going through that path of nefariosity. Um so, as you And as you can see the as the nefariosity um meter, so to speak, increases, the uh the you go from un- unauthorized disclosure to through to workplace violence. So, there's a huge range of potential uh problems that you can see in a in many organizations. But, you can also see that there's a ton of potential behaviors. And yes, this is an eye chart on purpose. Um again, all the slides will be shared, but this list is directly out of the 2024 IBM cost of an insider risk report. Uh

I don't know if any of this matters. So, typical factors um in raising or lowering a risk. Narcissism. Machiavellian manipulativness. Psychopathic lack of empathy. Anger grievances disgruntlement. A desire for revenge, situational stressors such as workplace grievances. um being passed over for promotion for promotion, lack of recognition in your workplace, workplace bullying, feelings of unfairness or favoritism of others. Maybe there's a temporary opportunity, um and you you know, a tempting opportunity and you take the client list with you. You pop out the door, off you go. Another company might just hire you, right? Well, then there is the social engineering the social environment at work, at home, uh perhaps a life event, a wedding, a death, a birth, a divorce,

or a little bit of extra cash in your pocket if you plug in that USB drive to the end of the office. So, all of these have an effect and potential option that causes increases to the to the to the likelihood of insider risk. What are the motivations? So, the traditional was mice, money, ideology, coercion, and ego. Um I I've seen some very interesting ones that are a little bit more modern modern that come really down to fa- finances, fame, fun, or um you know, or just F because they you got because of some state actor had something over you and they decided to convince you that you were going to do something. But, this is really financial uh

espionage or grudges. Um convenience is an interesting perspective to to consider as well because the the likelihood that somebody is going to just pick something up because it just happens to be there is much higher than when it takes some work to go through that process of of stealing something and getting it out of your organization. So, unless driven by ideology, insider threats typically result from deteriorating employee relationships. So, most malicious business insider threats stem from workplace issues, though. Bad boss, bad team, bad culture, canceled contracts or organizational changes. Maybe watch those every time that you see that happening in your organization, start monitoring your employ- employees a little bit uh closer. So, some common fallacies. Uh we

aren't a target. Uh we're too small to matter. It could never happen to us. We trust our people. Nobody would ever do that. Hybrid and remote staff are more likely to be threats. And people who are bad at their jobs are all insider threats.

Um the extended detection time tends to reflect the sophisticated nature of insider threats. Uh they operate with a legitimate and legitimate access. Uh so, those users know what they're doing, they know what the systems that they're touching are, and it makes their activities hard to see because they blend in seamlessly within the organization and normal business operations until well after the damage has occurred. So, what about soft triggers? Um we've got new hires, resignations, role changes. Um how many organizations do background checks? What about when somebody changes roles? What if you went from, you know, an analyst to a manager or a director? Did they do another background check to make sure that you actually could still be

trusted in that new role? Um how frequently do they do them? Does the role really make a difference? I mean, system admins, security analysts, privacy manager, HR rep. Does it really matter? Or does it? Uh what about the CFO? Most IT departments report to the CFO. Um, and nobody argues with the CFO when the CFO wants something. So, should we worry about that? Uh, behavioral. So, did your staff complete any specialized training for that new tool or service? Have they threatened other staff? Or are they just complaining about their company compliance training or the way that the team the team management operates? What about bad performance reviews? Anybody had a bad performance review? Go on, put up your hand.

I have. Everybody has a bad performance review at some point. They may just not know that they've had a bad performance review. It's called a layoff usually.

So, these are some technical indicators to consider around your um, around different types of risk profiles. You can when you're building out use cases inside of any of the tooling that's available with with products that do inside of risk management. And my organization that I've worked in for years as many of you have seen me speak previously on Microsoft stock things uses the Microsoft stock. I'm not going to dig into any of that because we don't really have time to. Um but um, abuse of privileges out of normal hours, system or data use, unexpected privilege escalation, using your BYOD for another purpose for another work other than work purposes or using a personal BYOD. Um, for for work purposes

that you shouldn't have been using. Uh, data exfil. Um, look at the access rate. Where's it being stored? Is it being dropped into other cloud services? Is it going to USB? Uh removing documents or other equipment? What about physical documents? Uh we all love to exploit weak controls, right? Segment segmentation of duties, um lack of monitoring or logging, weak authentication systems, unpatched systems, excessive privileges, that snowball effect. If you've been with an organization for more than 10 years, that just goes on. So, um this is not a talk about insider threats that I've experienced. I will not be telling you about any executives that asked for their emails to be transferred from any previous companies.

I will not tell you about finance financial laundering of money or grifting. I will also not tell you about people who stole equipment, ran gaming servers through corporate firewalls, or used FTP servers to run ware personal ware sites, or large volumes of other media, or supported extremist groups. I also won't tell you about side businesses, or had friends wipe systems after they left, nor that they I normally tell you about directors that were were having illicit relationships. Anything that I come up cover in this will be uh theoretical, um or related things that there are public news reports on.

So, financial gain. Um there was a doctor in Windsor um some time ago that was fined for 12 and 1/2 thousand dollars for viewing records of newborn babies because he had a side business providing services for newborn babies. Um he claimed to not know that this was not allowed. Um compromised staff. Coinbase um outsourced their uh I I had outsourced their their services and ended up with rogue staff that leaked 69,000 customers data. In that case, they actually were taking photos of all the records. Like literally, they pulled out cell cell phones they brought in, took pictures of every single Coinbase record record, and then emailed them out and got 200 bucks per photo. Um Desjardins uh 2019 collected

information on customers with and then shared it with a third party. That was 2.7 million people. There's a ton of fraud cases. They just go on and on. Um unintentional breaches. Um data stored in uh in a vulnerable tran- file transfer tool, Moveit, ended up in the largest breach of uh of um patient records in uh in Ontario history. That was unfortunate. So, looking at your risk program, the first thing that you need to do is get executive support. You absolutely have to have executive support. You then need to sit down and figure out who your stakeholders are, build out that program ownership, define your guidelines, I address any legal obligations that you have, and then identify critical assets you

want to protect, build your policies and procedures and guidelines, ensure that you have a team and that they are trained to handle what they are dealing with. The rules of engagement are always key. Focus on the data that you have and the IP theft first. Um then go after things like um fraud. Uh it gets harder to detect the further down that um that complexity chain that you go. Um sabotage and violence are very difficult to to uh to identify. Um tie into your existing HR programs, any fraud prevention programs that you have, um and any other security programs. Uh for metrics, uh data exposure by uh event, uh data exposure events by severity, risk indicators by file,

um destination and user, percentage change in posture over time. So, this would be based on the second one, which is the risk indicators by file destination and user. Awareness training uh um for and completion rates. That actually has an effect. Um and then effectiveness of your detection methods. So, talking about policies, you have acceptable use policies, you have violence in the workplace policies, you probably have whistleblower and incident response policies. Use those. Use those as the basis. Um processes, you already have culture-aligned business guidance. You already have a team that's that that's involved with with organizational engagement. Um get involved with those. They are part of that program. Awareness training, focus on code of conduct.

Corporate policies and governance. Uh people have a different perspective when they understand the impact on the company and its clients. Um be transparent. If everybody doesn't know what's going on, you will never get this off the ground. Uh happy employees are less likely to be inside or threats. All of these programs support employee wellness. And major parts of them are are part of a successful insider risk program. So, your HR team though, they're absolutely key. You It's funny because you you think, "Oh well, HR, they just hire and fire people and that's all they really are part of." And sometimes we get them involved in No, your HR team is actually part of understanding your business.

They are understanding your staff. They are engaged in the program all the way through. They are your biggest um ally when you're going through this. Why? Because you have to engage them anytime you start an investigation anyways. And you don't want to be doing these investigations. You want to put the technology in place and hand it off to HR to actually have the conversations with the staff because they have the training and the ability uh to engage both the the staff the the management and the rest of the teams to be able to support that employee in in better behaviors as they're continuing on in their process. So, um they manage their people when they they

know when they join, they know when they leave, they know when they they they go through role changes. They're involved in all all of those those progressive discipline um uh in supporting uh progressive discipline. Responsibility matrices are also an important part of that tool.

So, when you start program, you have to advertise it. You have to actually tell people that you're doing it. You can't just light up an insider risk management program and think, "I'm going to hide this from all the staff, not tell them that I'm doing it." You actually have to have them involved and engaged and understand why it is you're doing it and how you're doing it and how it's engaged and what types of things that they're that are going to be initially monitored because frankly, they get they get terrified and then they they start to shut down and they don't engage with you. And that Remember that these are part of your um your the folks that are

going to support you. Build those relationships and processes. Build, buy, or test tools once you've gone through and used your existing tool sets. Start small. Use a single target group and then grow from there. Do not think that you're going to expand this to the entire organization at once. Deploy, report, iterate, and use feedback. Do not assume that you can do this in a single step. It has to be done iteratively. You need feedback at every step of the way. Um there's a ton of different in detection methodologies and tools. You can use all of them as you're going through. Um When you're thinking about privacy controls user um activity monitoring is not the same

thing as um as some of the other tool sets that do access or um activity or um system audits. User activity monitoring includes things like screenshots, keystroke capture, file content that they're actually viewing. It does shadowing of things, the shadowing of their screens. This terrifies people. They get really, really weirded out by it. But you may actually have some legislative requirements. You might not be allowed to do this. Um incident engagement, take a light touch. These are still your staff. They're still people that you might have to work with afterwards. If you go in all hot and screaming, "Oh my gosh, you've you're taking down the whole company. I've got to we've got to lock

you away." What What do you think they're going to do? They're going to shut down. They're not going to communicate with you. And then you find out that actually it wasn't them. It was there was something else going on or their their accounts were compromised. And now you're the idiot who treated them like garbage. And guess what? That's actually called violence in the workplace. You just actually bullied them in their workplace. And they're never going to come back to you again when you need them in the future because they're still a detection tool for other issues. Um handle those alerts carefully. Um as you're going through things like low-risk alerts, um just automate messages for them. Critical and high,

respond as soon as possible. Medium should be addressed about weekly. Uh and then the rest of it is just a you know, when you're considering especially with engaging people that any opportunity to engage with somebody is a good learning opportunity from either a cybersecurity perspective or an organizational risk perspective or even an insider risk perspective. Uh evidence collection, when you do evidence collection, be cautious and careful. Um you still have to keep forensic control of that evidence. And uh there's a whole bunch of additional recommendations that really come down to uh just follow a standard model. Make sure you're engaging with teams. Identify and increase um things slowly over time. Do the basics first. Always start with your people.

Get your policies approved in writing. Start small. Iterate with purpose. And tools only survive only serve as a tool as as a possible set of indicators. They are not everything. And the most important part is it's okay if your org is not ready for this. Most orgs are not.

There is a ton of resources and links. I am going to flip through them because there >> Um actually, I have a question. >> There's no space for questions, and that is it. >> [applause]