Are You Being Misled When It Comes To Mitigating Insider Risks?

Greetings everyone and short g' day to you all. The name is Buzz Fisher. We've got John of Fear there. Greetings.

Hello everybody.

Thanks for joining. Yeah, excellent. Look, today is another interesting discussion. We're going to follow up what we mentioned and talked about two weeks ago. Two weeks ago we talked about why organizations are being misled when it comes to data protection. Today we're going to talk about and I'm going to pose this question to you, Sean. Why are organizations being misled when it comes to mitigating insider risk?

Well, the answer is quite short. You know, organizations today understand that the human element is a major risk source and they invest fortune in different type of controls and appliances, identity management, access controls, DLPs, encryptions, firewalls, physical security, same log management, etc. But the reality shows us that the problem scene exists. So the question is how come they invest so much and they are being told that all of these solutions will help them to solve the problem while the problem is still there.

That's correct. Correct. I was going to say it's a big misnomer. The question, you know, when I look at from a perspective and we talk about it a lot, when we talk about an organization protecting their cyber, we tend to look at cyber. But when it comes to people who still look at cyber, and there's a lovely little quote that I wanted to relate which is basically if you tread water long enough, you'll sink and basically means that if you approach with the same set of framework or mindset to protecting your business, that is not going to actually work when it comes to dealing and managing the risk from people. So why do you think it is that organizations just have not sure how to approach in terms of mitigating insider risk?

Well, what I see and what we actually both see a lot with organizations that we meet when we talk about, for example, external threats, external risks, we see a very good understanding and maybe a good approach to tackle those risks from the right, from the external side. So we look at solutions on the cloud, we look at public facing solutions like scouring the deep dark web, threat intelligence and they get as much as closer to those hackers, spies or any other external threat actors that if they are caught they will be prosecuted. But the organization block itself from outside, which is good because if it's external, block it from outside. But when it comes to internal risks, insider risks, we tend to see organizations try to or maintain some kind of unseen gap. So they invest in a lot of solutions to and they try to get as much as close to the internal employee, but they still keep a gap. For example, if you have one DLP or 10 DLPs or identity management, password vaults, a lot of other good stuff. Still, it doesn't solve the problem because when it comes to insider risk, it's all about the intention and motive. And if those intentions are not being monitored or been changed, the problem is still there. So when it comes to inside the risks, it's like they don't really touch and reach to the. And those employees are there. That's the funny part. They are there in the organization. They're not hard to access.

I think that the most difficult challenge for any organization today we are in a pub. So I was going to continue sexually interrupting. So the biggest challenge organizations have today is there's no person. We talk about accountability or responsibility. There's no person or a group of people within an organization that say, yes, I'm going to put the cap on my hat and I'm going to be responsible for mitigating insider risk. What's a traditional approach in Australia and elsewhere? Let me exclude the US because they've got something different. The traditional approach is, well, we've got risk, let's throw it to the chief information security officer. But as we know and we've talked about often that, you know, their responsibility lies about protecting information and security systems. Dealing with people behavior is something completely altogether different subject. And they wouldn't have a clue how to deal with people. They'll try and do it from a technology perspective to try and limit what they can and can't do. But when it comes to their behavior, that's a different story. So the question is, who within the organization is going to take charge of managing risks? That comes from within and from my perspective and your perspective, there's a great, well, confusion but also not knowing. You know, we talk about conscience, competence. We don't even have that. They don't know what they don't know. So I mean, what they try and do is say, okay, we think we, well, we know there's a problem, but let's bury it somewhere so we don't have to deal with it. Let's hide underneath the carpet. Let's put it in the cupboards so we hope that it'll never bite us. And as I'm not sure if confusion is the right word, it's like, where do you start? Where would you start?

Yeah, look, the question is what's the process of identifying the problem and what and how to put a plan to solve it. So in today you know, situation. Usually the vendors are dictating the organizations what are their problems and they're promoting themselves instead of really solving the problem. Organizations, especially the business owners in the CXO level, they need to understand and realize that whenever they have a problem, whenever they have a, they're managing risks the whole day. And this is a big part of their work to manage the risk, to make sure that financials and IP are in place and the organization is still profitable and function properly. So they try to mitigate the risk in various ways. It starts with the physical security and with HR processes. And then they want to protect the data now for leaving the organization. Now in a parallel world where documents, files and USB sticks, they have their own soul. So they can decide to leave the organization by themselves, right? Controls should be in place to stop the data from going outside or to stop IP from flying outside the window. But in our world it doesn't happen without involvement of people. People are the source of everything. So if we know that the people are the source of the risk, but we don't treat those people and we look at the data, it's the same like when you are in a stadium watching a footy game and the guards that are placed on the stadium ground, they are facing the game, the players instead of the audience. And if something is thrown from the audience, then they will start to investigate, collect a lot of forensic evidence, calculate angles and wind speed, et cetera. Instead of just facing the crowd where this risk comes from, identify the risk and stop it. And also respond. So, so I think you said there is no confusion. Well, I think there is a lack of responsibility awareness who is responsible to people, incidents, you know, the same person in a company, it doesn't matter what role he function, he can be violent, he can commit sexual harassments, he can commit any physical damage, steal, fraud, even it misconduct or unethical behavior. Now each incident will have different responsible person in the organization. So when it comes to responsibility awareness, who is in charge of providing or entitled these responsibilities to employees?

That's a very good question. Because usually when you look at behavior, you would expect that the human resource would take over. But as we both know, that sort of been lacking. I mean it's been more, I think HR has been acting more as an administrator rather than manager. They're more concerned about onboarding people, candidates, new candidates and so forth. But from then on there's no higher level management. If these people have challenge, whether it be as you said, you know, if there's bullying or some form of misconduct, how is that treated? So often a treat of policy violation is looked at as a technology. So what technology control have they breached? Not from a perspective of what behavior they've breached. So often when you have things like bullying or those sort of aggressive behaviors, they're not even reported there. Again, they're sort of, you know, we see it, but we're not going to do anything about it because we don't want to get into a, an emotional discussion. We don't want to get into emotional situation where we don't feel good about challenging another person's behavior. So we allow them. That's why bullies know they can get, they can get away with it because they'll keep on doing because no one is actually standing up. And then even when they get reported, the managers don't do anything about it because they are afraid of standing up. So we have a situation which is really people related. And what we've seen also there's a huge connection when you have behavior manifesting itself from a physical element, then taking to a digital element. So we could have physical bullying and then that could take it into a virtual bullying. And again, how does the organization treat it? And that becomes extremely difficult and maybe that's a confusion or they're just not sure how to approach it. But from a technology perspective, it's more firewalls, more, you know, SIEM solutions, more DLP solutions to protect and ensure those policies and controls are there. But I look at it as just more of a tick in the box. It doesn't solve the problem and we both know it quite well. And look, how do you see the situation when we talk about compliance? I mean, you have a lovely story about compliance in regards to a driving license. I have a different story, but I'd like to get your idea, your metaphor.

Yeah, look, in all our sessions and in all our conversations, the main subject and the main topic is people. You know, when people get the driver's license prior to driving license, they don't know how to drive and they don't, they're not aware of all the rules. So they need to study all the rules. They need to study the signs, they need to pass the theory test and also pass the driving test, which by the way, they are the best driver ever in this driving test. Now after post the driving test they get the license which is basically they're getting the trust from the state, from the country that they allow them to drive. But from that moment their behavior is varied and they are not the best drivers. From that Moment one day they are good ones, that they are bad. They know the rules, they know the policies, they know everything. But still there are accidents. Why? Because that's the nature of people. And I have even a better example. And this everybody can rely, you know, relate to themselves. When we were young, our parents took us by hand and taught us how to cross the trail, you know, the road. They taught us that red guy is the bad guy and green guy is the good guy. So whenever there's green, we should cross. Now I challenge. Well, I ask each one of you that watched that video, when was the first time you decided to cross there? When was the first time you dared to cross in red light? It probably happens in some early stage when you thought there is nothing on the road, you looked right and left, you thought, well, you're safe and you ran. You did it very fast. And on the next few times you slowed, you started to cross with more, you gained confidence. And today if you go to the city, the CBD or everywhere, you will see people just crossing. They know the policy, they know they shouldn't cross. You know all the risks. They were taught not to do that. But people take calculated risks on their, on their, on their behalf. Now no organization should allow employees to take calculated risks on the organization's behalf. So when organizations understand today, and I think Boaz, you can tell the example of that financial controller that stole more than half a billion dollars from the Schnitz organization. She was the financial controller, she knew all the controls. She said the controls. She was, it's like the cat with a cat to take care of the cream. And she knew how to bypass all the controls. So if I asked the CEO of Schnitz if you had 10 firewalls and another 10 different identity management or access controls and let's say you have three or four very big and very expensive log systems same, would that stop it? He would stare in my look in my eyes with a big sorrow, but confidently he would be very confident with saying no. Because that employee could bypass even 100 firewalls. It doesn't matter. I think organizations needs to know to pick the right weapon for the right battle. If you fight with data and technology, if it's a data thing, do it with technology. If it's people thing, you should do it with people or people understanding.

Correct. I think what we related earlier on is that if it's on the outside, if it's external, throw it through your perimeter. And if it's internal, find the source of the problem and focus on the source, focus on mitigating the source. And then there's a big difference. Now, we talked about technologies, we talked about vendors. I wanted you to also relate a very similar story about, for example, the laptop. And because I'll give you a reference from my side and you know, it, obviously I approach an organization I size within a large organization. And I basically asked a very simple question. How do you manage inside risk and simple response? Well, we use a lot of management, we collect all logs, and that's how we mitigate our risk. So having said that, you know, again, this is about a misconception and being deceived by the organization. But it also could be, from their perspective, a shortcut. We talk about the path leads resistance, which basically, if you look at water as it flows down, it'll find the paths of least resistance. So people in their roles will look for ways that they can mitigate it as quickly as possible because then they don't have to deal with it. So knowing that and you know the story about the laptop, but what it can and can't recall, why don't you give a sort of a quick metaphor to dispel how effective it is? Yeah.

So when we ask, it happened many times that we ask CISOs, how do you protect yourself against people, incidents, and everybody proudly wave. We have a sim, we have two scene, we have log management, we collect everything. Now you ask yourself, well, if, if you have a system that collects all the white noise in your environment, you know, all the technical logs, all the system logs, and you collect it into one, into one machine. Let's take a laptop, for example. I am authorized to work in the organization and my laptop logs everything. You know, you have the event viewer, everything goes to the sim. Now I'll open, I got an email with a very sensitive Excel report. I'll open that report, I'll review the numbers, I'll copy some of the numbers, put them on a notepad, change the notepad, name the file name, send it via, let's say WhatsApp or Telegram, okay? And also I'll make a quick WhatsApp chat and maybe write an email. Now, if everything was logged, you, you just feel that everything will be visible, right?

A big wrong.

Because whenever we ask those CISOs or whatever position we ask, can you tell me what I just did? Nobody can have an answer because when you collect, you know, within the 20 seconds I worked, there were about maybe 3,000 log lines of events. Now, how can you, how can you think or can you be sure that. Well, in other Words. Organizations think that they can infer people behavior using logs or system logs. How come? What is the origin of system logs? It was designed by the developers for themselves, for debug purposes. How can you look at machine logs to understand people's behavior? It's crazy.

Why?

If you want to understand people's behavior, for God's sake, look at the people, look at their actions, monitor their actions. It's a different weapon for that battle.

Correct. And we talk about it often. I think if you're going to choose the technology, you need to be aware of how the technology is able to shape their behavior so that they can act in the best interest of the organization. So the question is that if you decide, well, a SIEM is really useful, it probably is if you want to manage your systems and your technologies and you want to understand the risks of those systems. But if you want to be able to effectively shape people, your employees or even contractors have got access to your assets and you want to affect their behavior so that they don't become a risk, then you need to find some appropriate deterrence mechanism to be able to do that. And so I think looking at what you have, you can actually quickly identify whether it can or it can't do that in a good way. So look, we're getting close to the end. I was going to actually ask you then, what are the takeaways from what we've talked so far?

Yeah, so you, you just talked about that a few moments ago. When you look at your system, if something is broken in your environment, it will get fixed. If a door is broken, if a boom gate is broken, if the lift doesn't work, if a server died or crashed, if you ran out of space, everything is monitored in real time and it will get fixed. Organization understand that. So they know the systems very well so that they can protect it and manage it. When it comes to people, that's the problem. When people are broken, when people are not working so well, and I'm talking about people are sad, happy, frustrated, aggressive, etc. Etc. You have, I can stop tomorrow. You know, they name all the, all the characters, nothing is get fixed, nothing is get identified unless it's physical, if someone comes drunk to work or dirty clothes or is something visible, if it's not visible, it's a problem. So I think when it comes to people, people monitoring, look at people, people observation. And when you understand people actions, when you understand and monitor people activities and you can respond in time to bad behavior or early indicators of compromise, you can act and you can stop and deter. And by deterring people, by shifting them from good to bad, you actually have to change them and fix them and shape their behavior. So I think the key here is when you deal with people, you should look at people and put more focus on that. That's the source of the problem.

Correct? Okay. It was interesting, actually. Yeah, that's a good takeaway. I think the idea, for example, just to make it sort of down to basic language. So, for example, when you're driving, because we like using driving as a good metaphor. So when you have, for example, speed cameras that you know that they're, they're going to actually shape your behavior. But the other thing I actually noticed today is speed bumps, because as you're driving, you don't want to go too quickly over speed bumps. So that forces you to change your behavior for that period of time. So there are many ways that organizations can go about helping people to act in the best interest. Part of it is what we call as employee engagement. How can we get people more engaged in a positive manner? And then the other side is then how do we use the tools and controls to best effectively provide guidance and deterrence for people or employees as such, to do the right thing? So that's my takeaway. So that basically covers it. So today we talked about, you know, just summing it up. We talked about why organizations are being misled when it comes to mitigating cyber risk. We talked about vendors. We Talked about why CISOs like to choose technology. We talked about that these technologies don't actually solve the problem. The problem is still there because they're not actually dealing with people. We also talked about the situation where organizations don't have a dedicated insider risk person. In the United States, you can set up an insider strip program, but we don't see it here in Australasia. We talked about vendors trying to help themselves to increase their cash flow. And we talked about, in terms of the confusion and misconceptions that organizations find themselves difficult to understand, where to start. It's a difficult problem. And again, we talked about people behavior as the number one. And when you deal with behavior, then it's a challenge. And again, organizations are not being trained to deal with behavior. So I think. Have I summed it up reasonably well?

No, I think you summarized really well. If there is a Pandora box and you're afraid to open it, doesn't mean it doesn't exist. If there is a problem and you don't have the right tools or the approach or you scare it to touch it. It doesn't mean it doesn't exist. It's like tooth cavity. Don't lose your teeth, don't lose your business. If you have a people problem, start to look at people.

That's the.

I think that's the key.

Correct. And with that, what we'll do is we'll take a. Well, I'll ask for your permission just to talk about what Sean does and what my company does. And so if you are looking for a situation where you might have a risk, could be whether someone has breached a policy within your organization or you fail a security assessment and it's looking to come from people or you're looking to increase the maturity of your organization. Look, reach out to Sean or to myself. Sean. Sean looked at very much the technology side of things about the controls and policies that most affect employees and organizations to do the right thing. And I come from the strategy to help you mitigate the risk. So if you've got a concern about how your organization's maturity reach out to us because we can come and do a number of different things, one of them could be an insider risk assessment. Sean, you were going to mention something as well.

Yeah. So whether it's an ip, theft, data breaches, policy violations, financial fraud, human processing errors, even the workplace, unethical behavior or. Well, it's very relevant to today the work from home, lack of visibility and control. It's all about people. And we can provide the technology to enable you organizations to identify, detect, deter and disrupt human risk element. Using various tools and techniques, we can help you be in control and reduce the risk in the organization when it comes to people.

So an easy way for you to engage with us, Sean is actually providing a free consultation that you can book your time. So that's probably the easiest way to get started. Sean Nutty gets me involved. So we'll happy to chat but we'll have all those details below. So yeah, feel free to reach out. This is a free consultation so it's worth quite a bit of time and money but it's free for you so take advantage of it. And look, that's basically what I wanted to talk today. It's been a much shorter live streaming webinar, so that's good. And with that I think we'll. Well. What's happening in Fortnite? We haven't decided. We might have a guest, but we'll identify that pretty soon.

Let's give this in a surprise. We'll give you a surprise, guys. Subscribe below. I'm happy to get your comments and any suggestion for future sessions. And thank you everybody for joining today.

Great. Thanks. Cheers, guys.