The Critical Role Of Counterintelligence In Preventing Insider Threats

Hello and welcome to the Australian Institute of Insider Threat. This is the 4th week of the Global Insider Threat Awareness Month called GITM. Hi, I'm Boaz Fischer, and I'm the founder of the Australian Institute of Insider Threat. In today's video, we have a special guest all the way from Biloxi, Mississippi, USA. I hope I pronounced it correctly. Yes. Ryan Rambo, who is the Executive Vice President of IXN Solutions, focusing on the defensive counterintelligence. Spies might seem like a throwback to the early days of the Cold Wars, but they are now more common than ever. They're targeting our critical nation's assets, and in today's video, we are going to answer why and how counterintelligence can help in minimizing insider threats and the risk from people doing bad things. Welcome, Ryan. Glad to have you on board.

Well, thank you so much, Boaz. And I'll tell you, I am honored that you asked me to do this video. I'm thrilled. Um, I guess for your audience, uh, I'll tell you a little bit about myself. Um, my name is Ryan Rambo. I spent 26 years in the United States Army. The last 16 years, I was a counterintelligence special agent conducting investigations collection activities and operations against foreign intelligence entities across the globe. During that 16 years, I spent 2 years in Germany, 3 years in Korea, many, many years in the Middle East region and Afghanistan specifically. And so I got an opportunity to see espionage, counterintelligence, and insider threat activity from a wide or a very wide range of different locations and places. So after I retired from the Army in 2016, I then entered into the corporate environment where I stood up counterintelligence and insider threat programs for the last 8 years. So pretty exciting topic that we're going to discuss today. And I'm really looking forward. Thank you again for bringing me on.

Thanks, Ryan. It's a pleasure always. Let's start with the basics. What do we mean by counterintelligence?

Very easy question, very hard to answer. And so I will tell you that I think there's 2 clear distinct definitions of counterintelligence. One from the national federal level, which I would define it as a complex intelligence field that involves law enforcement, military intelligence, and civilian intelligence agencies working together to stop adversaries from collecting on our national security apparatus. At the corporate level, though, I think it's a bit different. It's not about spying or catching spies so much. Instead, it's a multifaceted approach to safeguard employees, customers, partners, intellectual property, strategies, and critical technologies from those who wish to exploit them. And in the simplest form, I think there was a definition given by Robert Baer in his book, The Fourth Mole, He defined it as the practice of keeping enemies outside your walls and catching the ones inside.

So are you looking for, I sort of read it somewhere, betrayal? So really looking for people that might betray, would that be the sort of analogy one can put?

Yeah, I think so. I think that's a very fair assessment. I mean, we're looking for people who for whatever reason, whether it's a significant life event, You know, some other aspect of their life that have, you know, transitioned them from being a loyal, you know, dedicated employee to a disloyal employee that's out setting out to do something nefarious that could cause damage to the company.

Yeah. What do you— so how do you differentiate between sort of defensive counterintelligence and offensive? I'm just very curious about that.

Yeah. And so we rarely talk about the offensive side, but we spend a great deal of time talking about the defensive side. Yeah. Defensive side is more, you know, it's outreach program, it's training and awareness, it's engagement. And we're not looking to take action against a foreign intelligence entity or an international terrorist organization. On the offensive side, though, It is completely geared towards going after that entity, either through double agent operations or other activities that, you know, really go after that target, which wherever it's at or whatever it is that we're looking to do. Can't get into a great deal of detail about it. Yeah. But there are 2 different sides of the same counterintelligence coin.

Okay. So what, what role does counterintelligence have or play in sort of protecting organizations from insider threats?

So I think counterintelligence plays a significant role, starting with the overall initial risk assessment. And then we move into the identification of threats, whether it's nation-state actors, competitors, other adversaries, criminal organizations, international terrorist organizations, depending on where you're at. And then using all of that information, then we can craft a training and awareness program to make sure that we're training the employees to be aware of these different threats, how to recognize them, react to them properly, and report them to security professionals. And then also, we assist in investigations and incident response. And in general terms, much like an insider threat program, it acts as a deterrent in many corporate environments. For sure. Just knowing that you have that program in place, You know, print may make people think twice about doing something, uh, this fall to the company.

Yeah. Look, it's a side question. So the deterrence is something I don't hear enough. It's very much focused about prevention, detecting, but not so much the deterrence. I was just sort of curious to hear what you've got to say about that.

Yeah, I, I, um, I found that, you know, having a counterintelligence program just speaks volumes to the seriousness that an organization's leadership takes regarding security. And so, you know, you don't want to have a conversation with the counterintelligence folks if you've been, you know, violating policy or breaking the rules or exfilling data or that sort of thing. Now, our whole program is designed to protect and, you know, take care of people and make sure that they're trained. But if you're doing something negative, it could be a deterrent. Yeah. At least at least the employees know that, hey, somebody's paying attention to this.

Yeah. Okay, cool. How can counterintelligence be used as a platform or an enabler to help detect insider threat within an organization?

Yeah, I believe there are 4 main channels of information which flows back to the counterintelligence and insider threat teams. These channels are employees, cybersecurity tools, open source information, and liaison with internal departments and also external organizations. CI professionals use their experience and training to ensure that channels are properly tuned in to pick up on indicators and warnings of insider threat activity or external influences, which may be a motivational factor for someone to become an insider risk or insider threat. Our professionals also have a deep understanding of the indicators of espionage, which most insider threat cases obviously don't rise to that level. But many of the indicators of insider threat activity present themselves in a very similar way.

Yeah, because I think, so correct me if I'm wrong. I mean, things like risk profiling, behavior monitoring, you know, these are the things that when I think about counterintelligence, I usually look at, you know, some of these core techniques, if that makes sense, human intelligence, Is another way. So to help maybe the insider threat team, I sort of really get a better understanding and intelligence.

Well, I would clarify one thing though. I don't think so. I don't think that counterintelligence professionals profile citizens. Now we know that our adversaries do. Our adversaries routinely profile our employees to take a look for the right profile for them to make them more susceptible to recruitment. And so we try to defend against that as much as we can. And so I just want to make sure that there's a distinction there that counterintelligence professionals shy away from profiling anybody.

Yeah, you mentioned in your introduction about the idea of neutralizing the adversaries from maybe colluding with an insider and so forth. Can you sort of explain a little bit more about how counterintelligence helps in that regard?

For sure. I think counterintelligence professionals generally approach every reported concern as if it may involve collaboration, collusion, direction, or control from some internal or external element. And those— and that can range from everything from another disgruntled employee to a group of employees that have found a gap in the corporate environment's, you know, toolset or offerings and decided to start their own company, stealing our technology at the same time, all the way to nation-state actors, corporate competitors, and others. And so I think that's our starting point, since it potentially has the most significant impact if we can that that person is under control and direction of some other entity. And so we investigate and gather evidence in a way that preserves further investigation by federal law enforcement when it's necessary. So, yeah, I think we spend a great deal of time as counterintelligence professionals studying our adversaries, especially nation-state intelligence organizations, some of their historical failures and successes, their collection requirements, the geopolitical side of things. So I think that's That's all of the good stuff that counterintelligence professionals bring to the fight.

Yeah, very, very interesting. So one of the key questions that I want to ask you is artificial intelligence. Given it's had such a big play in the last 6 months, how has that impacted both in terms of gathering information or evidence, as you say, but also used as a tool? To help you maybe solve cases.

It's definitely exceptional. And just as a side note, all the answers that I'm giving you today came from artificial intelligence. None of this is originally my stuff. That's partly true. But no, I think it's very important. It's the future of technology. It's changing the way that we take a look at stuff. And I know that many security vendors are also using artificial intelligence. And if you believe everything that they say, it's making a world of difference. But I'm not convinced that it is there. But I do believe there are technologies on the market that are quickly learning what baseline activity should look like based on user activity or user roles and access levels. And then the artificial intelligence will look for anomalies whenever people in similar roles deviate from the baseline. And so I think there are some— there's a lot of value in what they're doing, plus it scales very quickly. You know, so you can cover down on large organizations using this technology. But I don't think it's at a point to where it solves all of our problems just yet. I think at this point we have to consider AI as just another tool in our toolbox.

Yeah. And

I'll reiterate that, you know, employee reporting, OSINT, and liaison, I think, are just as important channels as any technology tool that we have.

Very interesting because I think a lot of the technologies that I've seen or come across recently have been promoting as one of the key differentiations is that AI that's been embedded as part of the security solution. And I'm not sure whether it's generating a better outcome. Yeah. In my opinion. But look, what does it take for someone that is thinking about Going into counterintelligence, what are the skills necessary for working in such a role?

Well, first you have to be devilishly good looking. But I would say, I'm sorry, I'm American. I've got to throw those things out

there. Yeah,

that was all good. Honestly, I think great counterintelligence professionals are analytical thinkers with an emphasis on kind of history and geopolitics. They have great investigative skills. They're capable of walking step by step, like a checklist mentality, through investigations. They have high integrity, discretion, adaptability, cultural awareness and intelligence, attention to detail, detail and interpersonal skills. I mean, we have to be able to communicate and talk to people. But in my opinion, one of the most important traits that counterintelligence professionals should have is patience. Building and running a corporate or government defensive counterintelligence program rarely shows an immediate ROI. It takes time to understand the operating environment, threats, risk, personalities, and to become a trusted member of the team. And in many cases, it takes time for an insider threat or counterintelligence investigation to unfold as well. So you may get a piece of the puzzle today, another 3 months from now.

Yes.

And so on and so on until you get a full understanding of the threat or risk that you're facing. So I would say Patience, analytical thinking, and a great memory are extremely important. Plus the good looks, by the way.

Plus the good looks.

You've got the good looks too.

What is the difference between an accounting intelligence officer and an insider threat analyst?

I think counterintelligence professionals look at the world You know, through a larger prism. And I think because counterintelligence professionals spend so much time studying the adversary, you know, nation-state intelligence organizations or international terrorist organizations, criminal organizations, I think it gives them a broader scope and scale of security from that standpoint.

Yeah.

It's been my experience that I've seen insider threat analysts that are really solely focused internal. And sometimes that causes them to miss some of the bigger things that may happen in some of their investigations. But that's just, that's just my, you know, kind of speculation at this point.

Yep. Yep. Interesting. What are some of the biggest challenges that you see or faced in regards With counterintelligence addressing insider threat or just general threat?

Yeah, I think the biggest challenge that I see facing both counterintelligence and insider threat fields is where do you place the teams in a corporate structure where it makes— where it gives the most impact? Most CI teams that I've seen in corporate environments fall under the Chief Information Security Officer. I love Chief Information Security Officers. This is not a knock on them, but they're Really, and they love their cybersecurity tools.

Yeah.

Anything that deviates left or right from that makes them feel a bit uncomfortable. It's a little squishy for them. I've also seen other companies put their counterintelligence and insider threat programs inside the legal departments, which again makes sense until you have to have access to cybersecurity tools to pull logs and, and that sort of thing to conduct an investigation. So I think we're still trying to figure out where the best placement is for these teams. But if I were king for a day, understanding the whole-of-society threat that our organizations face, I would mandate every organization have a chief counterintelligence officer.

Oh, okay.

All of the security functions. And those security functions are physical security, information security, personnel security, cybersecurity, and compliance. Somebody somewhere inside the corporate structure has to see it all and has to make determinations of whether or not there's bleedover between the security disciplines or not.

Look, you've raised a very, very important point there. And I don't think it's done correctly. Definitely not in Australia. You know, I would expect the US to be in a much better position than what we are. But, and then this is usually a set of different layers that people have to go through. So the idea, for example, of insider threat or someone that's managing insider threat being able to report to the CEO is very rare. Yeah. So there is, they might have to report to the chief information security And that Chief Information Security Officer may have to report to the Chief Information Officer. And so you have all these different layers until it reaches to the CEO. So, look, very, very interesting point you just raised. What role does human behavior analysis play in counterintelligence against insider threat? So just Curious.

Well, first off, I love your book, uh, 42 Risky Behaviors of an Insider Threat. It's just fascinating and a great, great read. I recommend it to all— everyone in your audience and everyone that sees this video. Well, counterintelligence professionals should all be awarded, I think, advanced degrees in human psychology. I mean, that, that's the world that we live in. We spend a great deal of time understanding personality traits, motivations, vulnerabilities, significant life events, and the center saints spectrum of where each one of these could potentially fall on. And then we also, you know, explore how all of these things play out in human behavior. So having a foundation in human behavior analysis and how it presents itself is critically important for us and insider threat professionals to recognize, as it may be the indication that we need to, you know, either prevent it or You know, take action against it.

Yeah. So given now that we are in the Insider Threat Awareness Month, both in the US and Australia, how can counterintelligence help organizations in raising awareness amongst employees and management?

Yeah, I think we have to, you know, I love web-based training. I think it's great for compliance, you know, it hits the masses. But as counterintelligence and insider threat professionals, I mean, we really need to get down into the small group and one-on-one level for training and awareness. And I think having that dialogue, that conversation in a very intimate fashion where people can ask questions and get immediate feedback, or, you know, that's our— in many cases in these small group sessions I've seen where it's like, wow, now that you mentioned it, this thing happened to me not too long ago. You know, maybe this is interesting for the group.

Correct.

And so I think by fine-tuning our approach and doing a great job with the setting as far as small group or one-on-one, we can actually generate— one, create a better culture, but one, two, you know, build a relationship with the employees that are so critically important to us understanding threats and risks that may be emerging. And then also, you know, teaching them to react You know, to recognize, react, and report these types of things.

Yeah. So I think there is a malaise maybe, or an approach of also check ticking, which is basically here's a program or here's an awareness program for the entire organization, but it's not tailored to different groups within it. So someone from, let's say, finance will find it very different, will have different risks compared to someone from, let's say, software development Or from information technology or physical. Um, and, and the, the challenge is, is why should people care is not given as part of the training. So they're very much the same. Look, just go and do the training. It's gonna take you an hour, do a quiz and see you later. And they're not gonna remember anything, uh, 2 weeks later.

No.

That's, you know, that's what I've

seen. They remember going next, next.

Yes, exactly.

Save it and email it to whoever the compliance officer is checking on it. And I love that you bring up the tailored conversation side of this because a lot of times we lose sight as security professionals that different threats and risks are gonna present differently to different people. I mean, you may have an entire team that never travels, but then you may have another team that travels internationally, you know, every week or month. The training has to be different and it's to address different concerns.

Yeah, it's gonna answer the question of what's in it for me in terms of what material do I need to do to be able to do my work in a safe way, in a safe manner. How do you How do you measure the effectiveness of counterintelligence?

CI metrics, our counterintelligence metrics, are tough. I'm pretty sure it's tough for insider threat programs as well, after seeing it. Because a lot of times, even though we can have the best training and awareness program, have our cybersecurity tools fine-tuned to alert us to anomalies and troubling behavior, our OSINT platforms can be looking out into the social media platforms and websites for articles that are leaking out, Yeah. About our companies and that sort of thing. And we can have an excellent internal or external liaison program, but the company just may not have insider threats. And so I don't think that our efforts are in vain, even if we're not catching insider threats. But with this in mind, I think there are things that we can use to get really good metrics, and it's based on our output as a program. So for example, like training and awareness, you know, the numerator is how many employees are trained over the denominator denominator, which is how many employees do we have? That's your percentage, you know, total trained, counts of employee-reported concerns, investigations that led to an employee action or whatever. But these types of metrics based on your outputs, the engagements that you're having across those 4 critical areas of reporting, I think speaks volumes. Yeah. And if you're doing that successfully, The benefit of the program will be apparent to anyone.

Yeah, no, good response. What are some common misconceptions that you've come across regarding counterintelligence?

So counterintelligence is not all about spies and being spies.

Yeah, yeah, yeah, yes.

That's I wish it was the case because that's the fun stuff. But, you know, honestly, our work is designed to protect organizations. It's designed to protect employees just based on the knowledge that we know things that our adversaries can do to employees to manipulate them into bad situations and criminal activity and that sort of thing. So our mindset is all about protection. Now, Some aspects of that may come across or look like espionage or spying or something like

that,

but for the most part, in a defensive corporate counterintelligence program, it is designed solely to protect. And, and that, I think, is probably one of the biggest misconceptions that we have of counterintelligence.

Yeah. Have you had a misconception where it seemed that counterintelligence is only fit for large organizations?

You know, I think there is some truth to that. I mean, there are organizations that probably don't need a counterintelligence program and they're smaller. But I have also seen smaller companies that had incredibly impactful technology that, you know, competitors and adversaries wanted or, you know, desired, that could absolutely— so I don't think it's really necessarily based on the size of the company. It's more about the intellectual property and technologies that they have that would either justify or not justify having a counterintelligence program.

How's counterintelligence evolved over the years?

I think it's refreshing to see more counterintelligence positions and programs opening up in the corporate space. Historically, we've depended on our governments to provide us this service, this overarching umbrella of counterintelligence that protected both our national security information and also filtered down to protect our corporate environments. But now what we're seeing is that our, our countries are facing a whole-of-society collection threat. Um, the world is flat. Social media, you know, the internet, all of these things, cyber. So with all of these different threats that are arising in our society, it's unreasonable. It's an unreasonable expectation to expect that government is going to protect us from all of these different things. And so we need to adopt— oh, go ahead.

No, no, I was just gonna sort of, so it's a sort of follow-up question, which is basically where do you see it being, let's say in a decade time or in 10 years' time?

The counterintelligence space? I think it's gonna grow. I think, you know, companies are gonna see the value in it. I think we are going to see universities Developing training programs and certification programs to start fielding more counterintelligence professionals faster. Now, of course, they're going to be young and, and not as experienced, but if they latch on to a mentor like me or you that can guide them through the process and teach them more, I just see it growing. And it's going to be a great, you know, public-private relationship where We're keeping each other aware of different threats and risks that are arising and facing our country.

Excellent. What advice would you give organizations that may be looking to start a counterintelligence capability, or someone that has already started but looking for ways to strengthen their capabilities?

I would recommend that they reach out to a counterintelligence professional, obviously. I mean, there's several of them that are outside of government now and doing great work in industry, and then bounce the idea, have a 30, 45-minute conversation and just talk about what it is that you're hoping to gain from having a counterintelligence program. And I think an honest counterintelligence professional will tell you if there's value in it or not. And from there, just let the relationship unfold. And if it makes sense, then to build that capability out. And if it doesn't, then maybe make different recommendations to move in a different direction.

Cool. Ryan, is there a question that I should have asked you, but I haven't?

No, I don't think so. I think we've covered it all.

Okay. So let me conclude by asking you this key question. What is your takeaway from the discussion that we've had, but also from accounting intelligence by and large?

Yeah. So, well, again, I'm honored, you know, You're a hero of mine. I just discovered you 6 months to a year ago on LinkedIn. It's fantastic. The books that you've written are just excellent. And so I'm honored to be here. I'm also honored to talk about a subject that I really care deeply about, which is counterintelligence, especially in a corporate environment. In fact, I have a podcast called On Intelligence. Which is kind of a funny take on counterintelligence, but it's called Unintelligence, the Corporate Counterintelligence Podcast. It's me and Dave Holder, my, my partner in crime. We talk about how to build a corporate counterintelligence program and what it's like and all these things. You can find it on Apple, Spotify, YouTube. And so we have many different venues that you can reach out and find it. But no, The key takeaway is thank you for allowing me the opportunity to raise awareness of this important discipline and also just to have this conversation.

It's a pleasure there, Ryan. What is the best way for viewers that want to reach out to you? What's the best way for them to contact you?

Please reach out to me on LinkedIn. I'm Ryan Rambo. I'm on LinkedIn. I have a pretty strong presence there. So please feel free to to DM me, connect with me, start a conversation.

Great. Thank you, Ryan, much. I really appreciate it. Lovely to have you on the video with me and talking about accounting intelligence because I think that's a really important topic and I think it's gonna become a really important topic in Australia in due time. With that being said, thank you very much for everyone who's watching it. And if you've got any questions, feel free to either reach Ryan or myself in regards to counterintelligence. Thank you, Ryan.

Thank you.

Cheers. All the best.

Cheers.