1.1 Introduction to the Insider Threat and Motivating Factors

Video Activity

Join over 3 million cybersecurity professionals advancing their career

Required fields are marked with an *

View all SSO options

Already have an account? Sign In »

Insider Threats

Course

Time

2 hours 11 minutes

Difficulty

Beginner

CEU/CPE

Video Transcription

00:00

Good afternoon. My name is Ross Competent. I'm gonna be your instructor for this course entitled Insider Threat Essentials. In 75 minutes, we're gonna do exactly that delivered to you the foundational understanding of this subject. In a short amount of time, it's gonna be fast. It's gonna be furious,

00:19

but it's gonna be fun.

00:20

Let's get started.

00:23

So course objectives.

00:25

We're gonna start out with the review of what the inside of Threat is, and then we're gonna dig into module war motivating factors. And this is where we're gonna talk about

00:36

why people do what they do and then muzzle to We're gonna talk about attack methods, how they do what they do.

00:43

Module three, we're gonna talk about real world attacks and take those examples and bring these concepts into the real world and explain what kind of devastation these type of attacks can cause and that they have caused in the real world. And mounds of four. We're gonna talk about

01:02

prevention

01:03

and detection, and this is a in tools and technologies, and this is such an important area, it's gonna be a little bit longer than the others. And then also five, we're gonna talk about policy and process, which is the foundation of your insides right program. And we're also going to talk about the process

01:23

for ensuring

01:23

the highest level of trust for your employee base and also ensuring that we can lower risk as much as possible so that we can hopefully prevent the insider threat attack.

01:38

The insider threat

01:40

is similar to the threat

01:42

of external hackers, but the perpetrator happens to be

01:48

your co worker,

01:49

your friend,

01:51

someone you trust someone you work with with in your organization. You don't know who that person is, but they are there.

02:00

That's the concept of the inside of a threat. It's elusive. Okay, While many of the cyber security concepts are the same,

02:07

the approach is different because the insider

02:13

again is on the inside. It's not somebody outside defense that you're trying to keep out. It's one of your own.

02:21

They are there with you.

02:23

So as singing

02:25

with the Edward Snowden incident. It can't be more devastating than a traditional attack,

02:31

and we're snowed in. You'll learn about him a little bit later. But he was this contractor who worked for the National Security Agency for the U. S. government and intelligence agency. And he was a like a system administrator jackknife, and he was able to steal, stuns off highly classified top secret

02:52

files and

02:53

bits of information and take it out on a laptop computer

02:58

and get it to a foreign country. He did a devastating attack against that agency, and it shows how powerful and how dangerous these insider threat attacks can be.

03:13

It only tastes

03:15

a trusted employee who is on the inside

03:19

to change their mind,

03:21

to become the bad after Intuit execute an attack.

03:27

You know the switches on the good side when they're hired. But all I have to do is switch over to the bad, and they are there.

03:34

They are exposed to the soft underbelly

03:37

of this organization of the network of the systems of the databases. That is the threat in initial.

03:46

So let's talk about module one. The motivating factors.

03:50

So what drives someone to become the insider threat?

03:54

There must be a reason why individuals change their minds

04:00

and start to do bad things start to act against the company in the organization who they previously

04:09

I had a good relationship with

04:11

So human beings are complicated and sometimes conflicted creatures were emotionally wired

04:18

creatures. And so

04:20

in many cases we could be very volatile. And definitely when it comes to changing our mind and our changing our actions.

04:29

So let's review some of the primary reasons why, uh, the threat emerges.

04:34

Okay,

04:35

so motivating factors,

04:38

some motivating factors include emotional factors, financial gain, espionage, activism. You know, you talk about whistleblowers, and then even accidents can be effect.

04:55

Okay, so let's talk about the emotional effect,

04:58

Okay? So while on employees may have had unwavering loyalty when they were higher, emotional factors could make them change their minds about anything in their life.

05:09

Uh, something that drops on someone emotionally like a ton of bricks can make them changed how they act.

05:16

Emotions like anger. Hey, fear, despair,

05:20

jealousy can drastically alter decisions that we all make. And it's You can see it in your everyday life with your teenagers, with your spouse, with people that are co workers on. Human beings

05:35

are wired to be emotional,

05:39

and so there's a lot of factors that could be involved with our emotions that can make us change how yak change our behavior and definitely change our behavior. in the scenario of the insider threat. And this, uh, can drive us to do things

05:59

that we would not normally do.

06:01

So if you are all of a sudden desperate to get money and you don't care how you do it, it is so important that you reach that goal of getting that money for whatever that desperate reason.

06:13

Um, you will do things differently

06:16

then you would have before.

06:18

That is an example of how emotions can just take control of a human being and and drive them to do things differently.

06:30

Okay, so we talked about how the emotions can be tied to the need to kid money.

06:38

So financial gain is definitely a driving factor when it comes to doing anything that we do as human beings. Most of us work to get money to be ableto live, while some people resort to doing nefarious things to get money so they can live.

06:57

Or for whatever reason, maybe it's for selfish reasons, et cetera,

07:00

but for whatever that reason is, financial gain is a definitely a very strong driving factor on So, like it says there that says they say money is the root of all evil,

07:14

and it's definitely important. An important driving factor for the insider threat,

07:19

for whatever the reason is, if maybe there's some, some outside source was trying to convince you to do something that you wouldn't normally do.

07:26

Money can be

07:29

the factor for you to change your behavior and change what you do.

07:36

Now let's talk about espionage. So espionage kind of conjures images of James Bond

07:46

or Mission Impossible things like that as far as movies go.

07:50

So there are two kinds of espionage that we're talking about here for the insider threat and their nation, state espionage and industrial espionage. Okay,

08:03

in nation state espionage,

08:05

that is a

08:05

country

08:09

organizing, planning and funding and effort against another country.

08:15

Okay, that is a nation state espionage and then an industrial espionage. It's essentially the same thing, except instead of a country, it is a company or an organization doing something, doing the effort against another company boring in the organization.

08:33

Okay,

08:37

activism. Activism could be a driving factor on, and activists is one who is driven by an ideal, for instance, a religious or political view

08:50

and can be a very strong factor.

08:52

Okay,

08:54

because the individual

08:56

may feel

08:58

that the goal

09:01

of the activism

09:03

is much more important than any ramifications that can be fall. The individual Okay, so that is activism.

09:13

Let's talk about the whistle blower.

09:15

The whistle blower concept is

09:18

an individual in an organization who observes something

09:22

that is wrong. They feel maybe they feel it's morally wrong.

09:26

Or maybe is a It's breaking the law or breaking the company policy. They are compelled

09:35

to turn that in to turn the individual in and to telling them to blow the whistle on them. Okay, so that's the concept

09:43

of the whistleblower.

09:45

Of course,

09:46

whether the individual is doing the right thing can be, um uh,

09:56

and if he scenario or in So, for instance, the individual may think they're doing the right thing.

10:03

But the company may not think so, doing the right thing.

10:05

So there may be a legal battle there, so But however it works, it is an individual who believes that something wrong is happening and they want to tell the truth. They want to expose it.

10:20

So let's talk about accidents. Accidents, believe it or not, are a very big threat when it comes to the insider threat and While accidents obviously aren't done on purpose, they could still result in devastation

10:35

just like any other insider she do. So that's why it's in,

10:41

uh, in this course, because it's very important. Okay, the results the same, whether it's on purpose or whether it's not. If the result is devastating,

10:50

it's still devastating. It's still done by an insider, so you have to look at it as an insider threat. Okay, so this is an example of the American national security adviser who accidentally exposed something that some classified notes that he had put on a notebook right before the press conference.

11:09

And, uh,

11:11

so that is an example of a insider threat. Uh, another example, uh, can be seen was a scenario where a Sony Employees was was preparing to post a movie trailer for a multi $1,000,000 unreleased movie to YouTube.

11:30

They posted the trailer. Unfortunately, it was that acid him. They accidentally posted the real movie instead of the trailer. And so, you know, you know, countless thousands of people out there got to see the movie before it was actually released, probably costing millions and millions of dollars of damage.

11:50

And so that is also an example.

11:52

Oven acid. How an accident can be

11:56

very devastating.

11:58

Okay, this is a knowledge check. This kind of Ah, wait for us to try to quiz you and see how you how you're doing may be for you to observe how you're doing. So I'll read the question and I'll read the answers and then I'll show the answer.

12:13

Okay, So a blank insider is one who is driven by an ideal,

12:18

for instance, a religious or political view.

12:24

A emotional

12:26

be whistleblower.

12:28

See activists,

12:31

de espionage