The CERT Guide to Insider Threats

Dawn Cappelli, CISSP, is Technical Manager of the CERT Insider Threat Center and the Enterprise Threat and Vulnerability Management Team at Carnegie Mellon University’s Software Engineering Institute (SEI). She has spent the past decade working with organizations such as the U.S. Secret Service and Department of Homeland Security in protecting the United States against insider threats. Andrew Moore is Lead Researcher in the CERT Insider Threat Center and Senior Member of Technical Staff at SEI. Randall Trzeciak is a Senior Member of Technical Staff at SEI, and Technical Team Lead for the Insider Threat Research Group at the CERT Insider Threat Center.

"For years, researchers at the CERT Insider Threat Center at Carnegie Mellon's Software Engineering Institute have been collecting and studying data on real-world insider incidents. This year, they published a book cataloging the results of their research, called The CERT Guide to Insider Threats. This book is an invaluable guide to establishing effective processes for managing the risk of insider attacks, and it should be on every security professional's wish list this year. In general, the insider threat drives home the point that perimeter defenses are no longer enough. IT organizations also need to be able to see into their internal networks to identify suspicious activity." -- Tom Cross, Director of Security Research at Lancope, guest writing for Forbes CIO Central

• Preface xviiAcknowledgments xxxiChapter 1: Overview 1True Stories of Insider Attacks 3The Expanding Complexity of Insider Threats 6Breakdown of Cases in the Insider Threat Database 7CERT’s MERIT Models of Insider Threats 9Overview of the CERT Insider Threat Center 13Timeline of the CERT Program’s Insider Threat Work. 16Caveats about Our Work 20Summary 20Chapter 2: Insider IT Sabotage 23General Patterns in Insider IT Sabotage Crimes 28Mitigation Strategies 46Summary 59Chapter 3: Insider Theft of Intellectual Property 61Impacts 66General Patterns in Insider Theft of Intellectual Property Crimes 68The Entitled Independent 69The Ambitious Leader 78Theft of IP inside the United States Involving Foreign Governments or Organizations 83Mitigation Strategies for All Theft of Intellectual Property Cases 88Mitigation Strategies: Final Thoughts 97Summary 98Chapter 4: Insider Fraud 101General Patterns in Insider Fraud Crimes 106Insider Fraud Involving Organized Crime 115Organizational Issues of Concern and Potential Countermeasures 120Mitigation Strategies: Final Thoughts 126Summary 127Chapter 5: Insider Threat Issues in the Software Development Life Cycle 129Requirements and System Design Oversights 131System Implementation, Deployment, and Maintenance Issues 136Programming Techniques Used As an Insider Attack Tool 139Mitigation Strategies 142Summary 143Chapter 6: Best Practices for the Prevention and Detection of Insider Threats 145Summary of Practices 146Practice 1: Consider Threats from Insiders and Business Partners in Enterprise-Wide Risk Assessments 151Practice 2: Clearly Document and Consistently Enforce Policies and Controls 155Practice 3: Institute Periodic Security Awareness Training for All Employees 159Practice 4: Monitor and Respond to Suspicious or Disruptive Behavior, Beginning with the Hiring Process 164Practice 5: Anticipate and Manage Negative Workplace Issues 168Practice 6: Track and Secure the Physical Environment 171Practice 7: Implement Strict Password- and Account-Management Policies and Practices 174Practice 8: Enforce Separation of Duties and Least Privilege 178Practice 9: Consider Insider Threats in the Software Development Life Cycle 182Practice 10: Use Extra Caution with System Administrators and Technical or Privileged Users 187Practice 11: Implement System Change Controls 191Practice 12: Log, Monitor, and Audit Employee Online Actions 195Practice 13: Use Layered Defense against Remote Attacks 200Practice 14: Deactivate Computer Access Following Termination 203Practice 15: Implement Secure Backup and Recovery Processes 207Practice 16: Develop an Insider Incident Response Plan 211Summary 213References/Sources of Best Practices 214Chapter 7: Technical Insider Threat Controls 215Infrastructure of the Lab 217Demonstrational Videos 218High-Priority Mitigation Strategies 219Control 1: Use of Snort to Detect Exfiltration of Credentials Using IRC 220Control 2: Use of SiLK to Detect Exfiltration of Data Using VPN 221Control 3: Use of a SIEM Signature to Detect Potential Precursors to Insider IT Sabotage 223Control 4: Use of Centralized Logging to Detect Data Exfiltration during an Insider’s Last Days of Employment 231Insider Threat Exercises 239Summary 239Chapter 8: Case Examples 241Sabotage Cases 241Sabotage/Fraud Cases 256Theft of IP Cases 258Fraud Cases 262Miscellaneous Cases 269Summary 273Chapter 9: Conclusion and Miscellaneous Issues 275Insider Threat from Trusted Business Partners 275Malicious Insiders with Ties to the Internet Underground 286Final Summary 293Appendix A: Insider Threat Center Products and Services 299Appendix B: Deeper Dive into the Data 307Appendix C: CyberSecurity Watch Survey 319Appendix D: Insider Threat Database Structure 325Appendix E: Insider Threat Training Simulation: MERIT InterActive 333Appendix F: System Dynamics Background 345Glossary of Terms 351References 359About the Authors 365Index 369