The #1 Secret To Successfully Mitigating Insider Threats!

Hey.

Hi, Sean. This is a good start to our first virtual pub session. Now I hope, I hope you brought your beer. This is the most important part.

Very. Something cold and beautiful to crack the iron, Jack. Beautiful. What's that? Oh, that's the Stonewoods.

It's called the Stonewood. I don't know if you can see very well, but now you can. You actually introduced me to it when we went for a walk in the Butterwing. So it's been a really good staple.

Of mine being a favorite of four wheel driving. I got to know this one. It's beautiful. It's beautiful. We should cheers to each other once we get back to these isolations.

Yeah, yeah, yeah. Look, going really, really well. What about yourself?

Sunny and beautiful here, mate. It's great. Great day to meet.

Yeah, it is.

Thanks for joining.

It's been great. I'm looking forward to it. Looking forward to many of these sessions. So let's get cracking and greetings to everyone who's watching it. Thanks for joining us. We're going to run these regular, I was going to say podcast, but they're not podcasts, they're the virtual pub sessions about various interesting topics around the subject of insider risk inside of Shred. And today is no exception. I can see you're already starting on the good stuff. So let's start with you, Sean. Give me some of your background and what got you into this entire risk business to start off with. What's your background?

Oh, yeah. Well, that should be exciting. Actually didn't talk about that for quite a while. We go back in time 25 years ago when I just joined the army. So my background is from Israel and the army is a compulsory the service there. And I joined a very special intelligence force unit that was specializing in the people. It's called the Humant. And we were specializing in recruiting people from the other side of the border. Just forget, right accurate and important information. And the fun part in that, fucking call it. The fun was that the fact that we were, well, being a kid, you know, being an 18 and 19 years old, it was all about. It was like a game for us, you know, finding, allocating, identifying those people who had special needs, whether it was financial or it was a medical need or to help to someone, one of their family members, or even whether they had some weird ideology to betray their country. But our job was to find those people, make a friend with them, be friendly and then, you know, fine tune them and program them, changing their behavior so they will basically betray their country and provide us with very valuable information. So yeah, that was like four years on the service and I can't go really much into details but I can tell you that mate, we took people and it was like a play DOH in our hands. We changed them, we made them friends and actually some of them actually we brought them even into Israel as citizens after they finished their job. So after four years in duty I left the army and I just got into different roles at work. Find myself coming to Australia after a few years and funny enough I started to sell vacuum cleaners. So I took my people intelligence skills and I applied them on vacuum cleaner cells.

Talk about going from the extremes.

Oh man, no, it was a clean up mess whether it was in the army or outside. But the fun part was that that particular vacuum tin was sold only in home demonstrations. So I had to go and knock on doors every night. Just went off the streets and knock on doors and got into houses where people didn't even know what I was selling. And the whole deal there was changing their mindset and convincing people that never heard about that technology to buy it and pay $4,000 for a vacuum cleaner at the end of the night, which was great. So that was like a game, you know, psychology game. After a few years in that business I went back to Israel and I decided to combine my technology background which after duty I finished software engineering and psychological sales. So I found myself eventually dealing with the human behavior and technology. So that's why we're here, we're talking about the human element. And after a few years met you and we started to work together. And I can tell to everybody now it's fun, it's really fun.

What am I to say myself? I got a long story back and I probably don't have the time to do it on this video cast, but I'll give you a bit of a background. So you know most kids when they go to university, wonderful. What should I do? What profession should I do? Another time when I finished my year 12 degree they said, look, there's three key professions you can do that are highly in demand. One of them is economics, another one is accounting or commerce and the other one is computer science. I'm going, well, I just couldn't see myself doing economics or accounting. So that's how I started in computer science. But the computer science back then was all about programming programming on vex machines and PDP11s. I don't know if some of you guys know about it, but I came out at being a programmer. But I just couldn't see myself as being a programmer. So I wanted to have more that tactile relationship, business connection. And there was also a burning desire for me to understand what makes a business successful. Why can't one person go from with very little nothing, no money, and create a really successful business? What makes Tiger woods being the best golfer, what makes Roger Federbean the best tennis player? And so there's always a burning desire to understand me. What makes me tick? Why do I behave in a certain way? Why am I afraid of failure? And it's like everyone's going through the same route. So I really had to understand me so that I can make the business successful. So basically I got involved in learning what we term as neuro linguistic programming. And you can use neuro linguistic programming, which is the study of human behavior in various different areas. You can use it for health, you can use it for education. But for me, it was all about me. I really wanted to understand what made me tick. And so by going through the program, by being certified, by going over the years and studying and learning and reading, I became more and more aware about what makes people tick. And in the same time, I already had a business that looked at security. But the problem with security is how long is the piece of string. You could look at security from a penetration tester, from an auditor. For me, I suddenly realized that why not combine both areas? So being a cyber expert, but also being a people expert. And so now the risk from people became so much more interesting because I knew that I could actually really, really help organizations about mitigating. So that's sort of a long story short, but basically gives us a good background. So now that we've done that, what I want to ask is the basics. It's the basic what is insider threat to you? What does it mean to you?

Well, you know, it's funny enough, but I in my background, I recruited inside the threats. So I learned that from the other side of the equation. We found people that they had different motivations, different goals, aspirations, ideology, different problems. In majority, they we help people with financial problems or bringing their kids to our country for better medical treatment. So it was very emotional. And we got those people that had those special needs and we got them on time. That was sometimes, that was the tipping point and we got it on time. So for me inside, and I've been dealing with that on the other side of the equation, it makes no difference. For me, insider risks, for me, it's someone that has access to resources, access to a facility or to data, to information, even to people access to something that's important and valuable enough to someone else. And this is what we do. We try to identify and help today organizations to find who are those people that can put their organization in risk. This is inside the threat for me.

Yeah, for me. Look, I sort of break it down into two parts because we've got two words in this case. Who is an insider and what is a threat. So an insider, the way I've been taught is anyone that has access to your corporate assets. So it could be anyone that is a current employee or could be even an ex employee, could be a trusted business partner, contractor, a vendor that still has access to your resources. Somehow I would expand it even to.

Everybody, like a nanny, a plumber that gets into your house as an insider threat if he does something inside your house. So it's defining your parade, the secured or the perimeter. And whoever is within that perimeter and pose a risk in that perimeter is an inside the risk. That's what I understand. So it will extract it from the corporate world.

Yes. So we got the insider word and then we've got the threat. So typically don't look at a person as a threat. It's just that that behavior might be perceive as a potential harm. So I tend to like talking more from a risk side because really an organization is really trying to manage the risk which is caused by people's behavior or actions that could cause harm to the organization. But, you know, we've often talked about that and you know, we've often talked about this question. Why is insider threat perceived as a bad word? Why does it have in the industry sort of a bad connotation? Because, you know, we tend to look at it as, you know, we don't want to know about it, but it's valid. And not every insider strategy is malicious, correct?

Well, I think that a lot of people where they started to hear that term inside or inside the threat or inside the risk, it was from the news, you know, from the recent, you know, 10, 20, 30 years in the past, you know, well, people that were inside the fort and killed a king, they were inside the threats. People that, you know, raped their family members, they were inside the threats. People that stole from their employer. Even in old times, they were inside the threat. So apparently insider threat or people is the oldest problem in the world. Okay, so it was there all the.

Time.

In our industry. I guess in the cyber world, insider threat is more looks at someone like, for example, Edward Snowden or Julian Assange or those big Names that all these big incidents, very famous incidents that everybody knows they stole information but. And that's why the connotation or the people associate inside the threat as a bad word or with malicious, malicious intent. But to be honest, most of the inside the threats, incidents are not malicious at all. They are unintentional.

Correct. That's because people, yeah, I think there's a rough figure of around 70% of insider incidents are non malicious. And I think there's a confusion in the world or in the industry by and large just to look at as insider threat and saying that's bad. You know, as I mentioned, you know, if 70% of your risk or incidents comes from accidental or unintentional, it's just, you know, it's just a question of how do you now look at it and manage it? What do you need to do as such? Let me ask you another question. What's the typical approach by the industry to look at about mitigation?

Spending a lot of money. So basically, basically what we, what I see that a lot of organizations, they understand that, well, everybody manage risk, right? That's why they have doors and that's right. They have facilities and they're not working outside and they have windows to their buildings and they keep all their infrastructure safe 20, 30, 100 meters below the ground. So the organization invests a lot, I can say even fortune in different controls and different security measures in, you know, like identity management and access controls and physical equipment, physical guards sitting in and taking care of the building. They hide all the information, they put antiviruses everywhere. They try to keep their most valuable data, which is basically their business secured. But it doesn't stop anybody from doing a, posing a risk to the organization. They're not looking at people. So people are stepping into buildings every day. Nobody knows who are they or what are their intentions. One day they are good, one day they're bad. So that's the typical approach. Let's put a lot of controls, surround the building with a lot of, you know, it could be an armed army, but it doesn't stop someone.

Correct.

It doesn't separate the intent. And that's a problem.

Yeah, and we've seen that everywhere because you know, you could say, you know, name one organization that has unlimited budget, unlimited resources, technology people, I would say, oh, the NSA, the National Security Agency in the, in the U.S. oh yeah. They have an unlimited bucket of resources and yet they still suffer inside incidents. And we know Edward Snowden about it, but I can give you a number of examples like we had another guy called Harold Martin who over 25 years was taking confidential data back home. So no amount of technology that I can see really stops and addresses the behavior problem. And it's quite shocking.

I can give an example actually in a company I worked before, and I'm not referring to malicious intent at all, it was a software company, one of the development teams, they decided that the local backup service is not good enough for them. So on their own they decided to backup, use this free backup service on the cloud with no malicious intent at all. But in fact they send the IP of the company outside and it was discovered by mistake when they, when in one of the company meetings, they asked if they can buy, if they can change, upgrade the existing backup system because they're not using it. So they still asked, so how do you backup until now? Oh, we send it to the cloud where we don't know where is the data in where, and this is the ip. So it wasn't malicious at all. And they had good intention of keeping, you know, taking care of the data. They just weren't aware of that. And that was a problem. They were inside the threats, although they didn't mean to correct.

Yeah, interesting to say. And look, you know, Komsegu was involved. We had an incident many, many years ago. I think I briefly mentioned about it, but I think it's when we, when we initially started the company, we were not so much around security, but we used to be the typical network provider. We used to set up businesses and with networks and we had a contract with one of the government departments and they basically had a contract for us to come and install their machines with Windows and set it up. And we had a junior employee and someone, you know, we went through the process of finding out who he was, what's his resume, his skills, and he fitted what we needed. And his task on, you know, to perform was to actually set up those systems. Well, one day, actually it was a weekend, he. I got a call from the manager and it was a real shock. And he said, look, I think your employees taking some of our hard drives, taking them away, stealing them, that's bad. I was shocked. I was absolutely, you know, the last thing you would want to do is to cause a reputation damage by not delivering something that you promised to deliver, but make it look really bad because you actually stealing from the client, that.

Can kill your business.

Kill, killed the business with that government department. But when we confronted the problem to the employee, he said, yeah, I had to, because he had a drive problem. And he was. Back then disk drives used to be a thousand dollars each, unlike today. So he was selling those disk drives and trying to keep up his drug habits. And you know, who would have saw it? You know, it's not as if you go into their personal background and identify who they really are.

That's the challenge. Imagine if your cleaner that she comes every day to clean the office. You don't know. Well, you hired her because she, because of her skills and because she does a good job. But you don't know what's her background. And if something happened and she, I don't know. Oh, hey, see something on the table that can be sold somewhere and that can help him or he or she, you know, him or her. Sorry. To give him some financial benefit. I look at the green dot all the time. So look, I have another example and it's a story of a friend. He was contracted within with another team of three to implement a payroll system in one of the big four consulting companies in the world. And they were hired by them for about six months or something like that. Now my friend told me that one day while they're working, his colleague downloaded the entire payroll list and he was suddenly he was surprising me. The question hey, why you earn more than me while we doing the same job? And my friend was really embarrassed, but he didn't know what to do. But he noticed that the guy downloaded the list. Now the problem is they were given the keys. They were had the privilege to do that. Now this guy had. Well, it was revealed after it was he had a marriage problems, he was going through a divorce, he had a drinking problem, he was disappearing from the, from work long, long hours during the day to the nearest pub. And he took that list. They discovered that only after the one of his managers received an anonymous email claiming for blackmailing him, asking for money to another account somewhere in one of the tax refuge islands. And apparently this guy actually downloaded that list and sold it on the dark web. Wow.

Wow.

Yeah. So imagine that people are getting keys and although that organization, I can promise you, is protected with all the best breeds of name it. I don't know, I'm not familiar with all the technology, but firewalls and access controls, identity management and their background, his background was checked in everything. Imagine if they now double the amount of firewalls. Will it help? Or adding another 10 DLPs.

Will it help? No.

If that person is eligible to do that and it's a legitimate action, who will know? That's a big problem.

Yeah, yeah. So coming to a conclusion to this session. What you're seeing is sort of the key takeaway that you would promote to any organization. Listening to you talk to this discussion, what is something that would really benefit from them taking away?

Yeah, look wherever you are, a CEO or risk officer or an employer or even a business owner, I'm sure you take care of the business and you want to make sure you be profitable and, and your IP is secured and everybody take care of your interests. But who's running your business? People. And if we're not looking at people, we neglect a big portion of the risk. Because the end of the day organizations take care of the business and protect it. But protect it and ask yourself from who? And if the risk comes from people, you should look at people first, not on systems and data. And this is what, this is a very common problem today in the industry.

I love the story that you often talk about. You know, an organization is a group, a collection of people with a shared vision and a goal. But if you take the people away, what have you got?

You've got. There is no business.

No, exactly. And, and I often talk about one of your metaphors about having a child and a knife in a small room. And we can see there's a potential risk if you take one of those two items. There's no risk. So for me it's about the organization realizing that irrespective of how secure they think they are, there's always a risk because it's about people. And people behaviors change depending on what they bring with them on a daily basis. If they're going through a divorce, if they've got money problems or their drug habits, as I mentioned, that's going to reflect different on a day to day basis. I think organizations by and large assume the people are doing the right thing, that trustworthy come and do the job. And this is I suppose, given, but I see what organizations are turning a blind eye and saying, well, we don't have this problem right here, that problem exists somewhere else.

But that's funny Buzz, because you go, we sat in front of many CEOs and they said we are big happy family, but we don't allow this and that and we block this and that and we restrict people to this and that. So why do you have all these controls if you do think you are a big happy family? So you feel comfortable now when you have all these controls around you. But think again. What is your biggest fear? Why do you have these controls? Because of people. So don't forget that people can Take your business and fly to the sky, you know, and make it very profitable. But there is another side of that coin and everybody manage risk. The question is, do you know or do you put your tuck your head in the sand or you look at the risk in the eye and say, well, we don't ignore that or we acknowledge that people can take the business. It take even one person to take the business down. Have you ever wondered who holds the keys to your, you know, golden chest?

Correct. Yeah. So with that look, that's been great. That's sort of our first session look. If you've got any comments or feedback, we also would love to hear what sort of topics you would like us to talk in a fortnight time. We're going to run the same session. I can't remember the dates but Sean will send an invite and I'll send some invites and the topic of that conversation will be what type of insider threat types they are, which I'm sure you know most of them, but there's one type of insider threat type, one that you don't know about and it's happening in your own business right now. So that's what we're going to be talking about the next time. So stay tuned.

So mentioned that this session will be recorded, will be uploaded to our YouTube channel, Saberside Channel. Use the subscribe button below like us if you like it and I'll be more than happy to hear from you. And hey, we'll see you the next time. I look forward.

Sounds like a good idea. And cheers and Lechaib to you.

Cheers, mate. Happy cheeky weekend.

Oh, that's good. I have to open up. See you next time.

Bye bye.

Bye.