Managing the Insider Threat

No Dark Corners

Nick Catrantzos

• Publisher: CRC Press
• Year: 2012
• ISBN:
  9781466566569
• Edition: 1
• Topic: Business
• Subtopic: Management
• Index: Business

An adversary who attacks an organization from within can prove fatal to the organization and is generally impervious to conventional defenses. Drawn from the findings of an award-winning thesis, Managing the Insider Threat: No Dark Corners is the first comprehensive resource to use social science research to explain why traditional methods fail aga

PART I

Diagnostics

CHAPTER 1

The Problem and Limits of Accepted Wisdom

The greatest obstacle to discovering the shape of the earth, the continents and the ocean was not ignorance, but the illusion of knowledge.

Daniel J. Boorstin

INTRODUCTION

A frontal attack can be countered through force or maneuver, but a hostile insider attack may do its worst before activating a single defense. All a malicious insider needs to carry out an attack are access to a worthy target, an open door, and a dark corner from which to study and strike. Frontal attacks can be anticipated or met with traditional fortifications whose effectiveness is limited only by resources and imagination. However, attackers operating from within can carry out attacks that are fatal to an organization without requiring an opposing army or sophisticated weaponry. Given sufficient access and license, trust betrayers can be devastating. This we know, because insider threats repeatedly surface as an abiding concern for defenders. Nevertheless, insider threats remain statistically rare, making them more difficult to analyze, defend against, or anticipate.

What do we do about insider threats? Prevailing wisdom recommends doing more: look harder, submit our fellows and ourselves to newer and more microscopic security audits and restrictions, the better to detect our adversaries. How well do such defenses work? At best, results are mixed. At worst, doing more of the same delivers results more promissory than substantive, while alienating the average employee.

This book looks at the insider threat from a multidisciplinary perspective. It reviews the literature on this subject and draws on Delphi research tapping seasoned professionals with broad career experiences. Ultimately, the book arrives at an alternative to prevailing wisdom. That alternative proposes taking institutional defense out of the arcane realm of specialists and distributing the role more widely at the work team level. The proposed approach deputizes coworkers to take a hand in their own protection, as a copilot must be ready to fly a plane if the pilot falters by mischief or misadventure. The resulting team-level engagement leaves fewer places for hostile insiders to elude scrutiny, hence fewer opportunities to prepare and carry out an insider attack.

THE PROBLEM

The insider threat is an Achilles heel for any enterprise or institution targeted for destruction by adversaries. Although risk and vulnerability assessments skyrocketed in the aftermath of 9/11, as reflected in the federal subsidies promoting them, the security focus centered largely on vulnerability to attack of large populations.¹ In this context, adversaries were characterized as traditional attackers working as outsiders who generally approach their targets head on with brute force—precisely in the manner of the 9/11 hijackers.

In this context, the insider threat has generally attained secondary status. One possible reason is that there is a dearth of statistically significant data on hostile insiders. As a review of the current literature indicates, trust betrayal—whether in espionage or other fields—remains statistically rare.²,³ Where analyzed further, the insider threat has been subordinated to cyber security studies centering on hackers and disgruntled employees, ex-employees, or consultants.^{4,5 and 6} Although such studies have supplied value and focused attention on the problem, they have offered few solutions other than to advise added scrutiny. Data compiled to date suggest that the vast majority of insider cyber attacks have been either fraud-driven or moderate in scope and impact. In other words, such attacks remain less than devastating to the targeted employer—the modern, electronic equivalent of embezzlement or vandalism.⁷

Similarly, such studies preserve their narrow focus by intentionally excluding cases of espionage, while at the same time avowing that the threat remains real and advising ordinary, more-of-the-same solutions such as layered defense.⁸ Consequently, it is difficult for security practitioners to derive new insights from cyber-centric insider threat investigations and their attending platitudes. The net result is that today’s insider threat remains substantially as it did yesterday: frequently studied retroactively yet seldom yielding practical tools, tactics, or recommendations that would serve a defender in countering the threat.

The overall aim of this research was to identify countermeasures that defenders can use to prevent terrorist attacks via trust betrayers and thereby reduce the vulnerability of critical infrastructure and institutions. The journey to this destination involved applying lessons of experts from other, more mature arenas of defense from insider threats, such as workplace violence, line management, corporate security, and counterespionage. In the course of following this path, the inquiry also sought to answer, “If current indicators and countermeasures fall short, what should we do differently?”

TERMS OF REFERENCE

Throughout this book, the operational definition of insider threat is an individual and, more broadly, the danger posed by an individual who possesses legitimate access and occupies a position of trust in or with the infrastructure or institution being targeted. Hostile or malicious insider and trust betrayer also refer to the individual who represents an insider threat, although these two terms focus more attention on the individual than on the phenomenon. Infiltrator refers to a subset of hostile insider who sees himself or herself as an adversary before attaining insider status within the targeted infrastructure or institution. The infiltrator joins a targeted employer or group under false pretenses as a means of obtaining sufficient access to facilitate an attack. Institutions as used here refer to public and private sector enterprises, employers, entities, and organizations.

This book’s focus is on the kind of hostile insider that poses an existential threat to the institution. Accordingly, the foundational research described focuses less on unbounded definitions of insider threat that include malingering or contentious employees or naysayers who may pose a nuisance or cause difficulties for the organization yet stop short of bringing it down to its knees.

HISTORICAL APPROACHES

The body of literature on the insider threat owes its existence to analysts of different areas of focus, as examined and sampled in the sections that follow. Psychological and sociological analyses of those who betray delve into motivations and enabling social contexts. Studies and historical documents related to espionage lean heavily on memoirs, historical compilations, and showcasing of flaws and pitfalls. More recently, emerging concerns over cyber security and susceptibility of critical networks to denial of service attacks have come to the fore in government-sponsored studies on insider threats.

Increasingly, government works appear to subordinate the insider threat to cyber security studies,⁹ centering on hackers and disgruntled employees, ex-employees, or consultants who cause damage via computer networks. Although such studies have value, some have also limited their focus by concentrating exclusively on the specialized area of information technology.¹⁰,¹¹ Indeed, in one report to the President, infrastructure experts underscored this danger of focusing too intently on IT:

Essentially, the threat lies in the potential that a trusted employee may betray their obligations and allegiances to their employer and conduct sabotage or espionage against them. Insider betrayals cover a broad range of actions, from secretive acts of theft or subtle forms of sabotage to more aggressive and overt forms of vengeance, sabotage, and even workplace violence. The threat posed by insiders is one most owner–operators neither understand nor appreciate, and it is a term that is commonly used to refer to IT network use violations. This often leads to further confusion about the nature and seriousness of the threat.¹²

Efforts to develop predictive models to detect and thwart malicious insiders have ranged from a quantitatively based yet unproven formula¹³ to broad-based theoretical models designed mainly to predict the triggers that lead an assassin or radical group to take violent action.¹⁴,¹⁵ Others focus exclusively on detecting anomalous behavior in hindsight, on the assumption that trust betrayers are disgruntled and detectable by mistakes rooted in character flaws—while standing mute about infiltrators disciplined enough to avoid such mistakes.¹⁶ The literature contains much analysis on the psyches,¹⁷,¹⁸ social climates,¹⁹ and cyber vulnerabilities²⁰,²¹ associated with malicious insiders. Yet analysis appears more limited when it treats pragmatic lessons and inferential guidance that apply directly to practical countermeasures. However, research on threats from assassins to saboteurs suggests that applicable findings may be adaptable from indirectly related works and may offer more promise in charting a course to defending against the malicious insider who is more dangerous than a computer hacker.^{22,23 and 24}

Types of Studies on Hostile Insiders

The literature elucidating the insider threat divides into three general categories: individual-centered studies focusing largely on psychological motivations or social context, case study compilations with cases that are anecdotal or biographical, and government-sponsored studies focusing largely on cyber threats. Table 1.1 arrays these various approaches in relation to one another.

TABLE 1.1 Insider Thre...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Table of Contents
• Foreword
• Preface
• Author
• PART I DIAGNOSTICS
• PART II KEY PLAYERS
• PART III MAKING A DIFFERENCE
• Appendix A: Three Rounds of Delphi Questions
• Appendix B: Summary of Delphi Round 1 Findings Accompanying Round 2 Questions
• Appendix C: Summary of Delphi Round 2 Findings Accompanying Round 3 Questions
• Appendix D: Delphi Expert Comments and Stories
• Index