The Cross Section Between Insider Threat Awareness And Disaster Recovery And Business Continuity

Hello and welcome to the Australian Institute of Insider Threats. This is the first week of GITM, known as the Global Insider Threat Awareness Month. Hi, my name is Boaz Fischer, and I'm the co-founder and CEO of the Australian Institute of Insider Threats. And today we have a very special guest. His name is Rod Crowder from OpsCenter, and we are going to be discussing the integration of insider threat into disaster recovery and business continuity. So first of all, welcome, Rod. Fantastic to see you.

Thanks for having me today. Welcome. Pleasure to be here.

Yes. Rod, why don't you sort of give us an overview of yourself, your role, Ops Center, and importantly, I'd like, you know, people to understand what does that actually mean by being a lead instructor of the disaster recovery International.

Cool. Yeah. So look, my core business is a business called Ops Centre, established around 20 years ago or so, just a little bit over now. And we basically specialize in risk and resilience planning. So we go into organizations, excuse me, we look at their risk postures, what they have in terms of current resilience. We help them build plans, we help them build mitigation strategies, put those in place, test them, exercise and maintain them. So effectively, we look at all the bad things that can happen to an organization and help organizations mitigate against the potential for disasters and incidents to occur. And that can be of a technical nature, but it can also be of a business nature as well. So some of the work we do is around technology infrastructure and IT and so on, and some of it is more around the sort of business aspect. Yep. We're associated with the country representative, or I am personally the country representative of Disaster Recovery Institute International. DRI is the oldest not-for-profit training and certification and awareness body in in this space around business continuity and disaster recovery. And we have 20,000+ certified professionals around the world.

Wow.

And we're their representative here in Australia and New Zealand. So we run the certification and training courses on behalf of DRI in this region.

Brilliant. Brilliant. So let's get started. And what a better question to ask is, why should organizations consider including insider threat awareness as part of their disaster recovery and business continuity plans?

Interesting question. And BCP and DRP have traditionally been focused on premises. That's where it all started from, sort of back in the, you know, in the '80s and '90s, whatever, around everyone's coming to one location to work. All of the networks terminate there, all of the IT is there, all of the people there, and so on. And obviously in this modern-day age, things have moved on and, you know, with particularly after COVID, a lot of organizations, white collar and so on, you know, they can— people can work from anywhere. So there's a much greater emphasis on data and information and things that, you know, insider people, people inside the organization have access to that data and information. So it's really important from, you know, enhancing the security posture of the organization to consider what insider risks are.

Yep.

It helps obviously to improve incident response, minimize downtime, minimize disruptions on the organization. And we also find that there's compliance, increasing number of compliance obligations as well. So organizations need to be able to demonstrate that they've actually assessed insider risks and insider threats, and sort of building a culture of, you know, security aware in terms of those insider threats and risks. So yeah, it's really part of their holistic sort of risk management framework that, you know, they consider insider threats as a specific type of threat, you know, as opposed to all the others that can occur. Yes.

Yeah. From, from all the different types of risks that, that could be out there. So the question, my next question is then, is, is it difficult or how would you integrate insider threat awareness into these disaster recovery and business continuity plans?

Look, there's a couple of ways of building, building these plans and going about the process. DRI has a process, there's an ISO standard, et cetera, et cetera. Regardless

of

the specific type of risk, whether a threat, whether it's an insider threat or it's a flood or a fire or a pandemic, there's kind of a defined process. And really what you need to do with insider threat is integrate that into that existing process. So, you know, if it's a flood in the building or it's a fire or it's an—

Yeah.

Or whatever it might be. So really conduct a risk assessment. So make sure that you include critical assets and evaluate the insider threats as part of your risk framework. And following on from that, a business impact assessment. And they're 2 slightly different things. One is looking at, you know, the actual risks that exist and whether they will occur or not. If they do occur, what is the actual impact on the business from an insider threat perspective? And then obviously make sure that you build those things into those individual plans, right? So your disaster recovery plans, your business continuity plans. And once you've built those, then it's about training, it's about awareness, it's about rollout, testing, exercising, and so on. But it's a very new and emerging risk, insider threat. A lot of our clients really sort of scratch their head when we say, have you considered insider threat?

Yeah, I was gonna ask that question, which— or a side question, which is, From your observation, do you see organizations actually look at it?

Very, very rarely, Boaz, to be honest. It's really quite, as I say, a lot of them, it's a real light bulb moment. And we've been increasingly adding into the simulation. We do a lot of simulation, desktop simulation testing with our clients. So we design scenarios around their premises, their people, their infrastructure, their products and services and so on. And we sort of say, oh, let's throw in an insider threat sort of aspect to this. And they sort of look at us and say, yeah, I don't, you know, and then we sort of say, well, hey, You know, we've got all these people walking in every day with all this privileged access, et cetera, et cetera. So yeah, it's something that doesn't seem to really, you know, doesn't really feature very highly with a lot of our clients at the moment. So on their risk registers and frameworks, right? So

yeah. Do you ever sort of raise sort of, look, here are the different types of insider threats that could, you know, severely impact your organization or go through some examples or what would they be? Some of the most common examples of insider threat incidents that can impact an organization?

I guess, look, from our perspective, and, and, you know, there are different views on this, but I guess there's a couple of categories, major categories. There are accidental insider threats and there are deliberate threats, right? So the things that people maliciously or deliberately set out to do to harm the organization or to get themselves ahead or get some credentials, access to whatever it might be. And then there's the accidental things. And I guess there's, there's, there's those 2 sort of broad categories.

Yes. Yeah.

You know, there's malicious insider threats. So data theft or, you know, deliberate sabotage of systems, you know, compromising credentials, trying to take over someone's account for some reason, trying to violate policies and that sort of thing. And then there's the kind of accidental ones where someone inadvertently, you know, clicks on a phishing link or whatever it might be, or doesn't follow a procedure properly, inadvertently emails a confidential spreadsheet to, you know, somebody and it gets intercepted and so on. So I guess there's quite a few that, again, people don't necessarily think about all of these. and what the impact on the organization will be from a business continuity perspective. Now, we actually had one client recently where someone was actually feeling very undervalued and they actually orchestrated an IT outage. And suddenly they were the person that knew how to fix it to make them look like a hero and get a promotion, right? And it was, they were found out, but it was—

Oh, wow.

It was an interesting case where someone deliberately basically was feeling undervalued, feeling, you know, that they weren't valued in the organization. So they literally deliberately went out and caused a compromise to, you know, and then Of course, everyone's scrambling around and they were like, oh, you know, I'll fix this. And yeah, so they can come from all sorts of different perspectives, right?

Yeah. So normally I would start and sort of define the topic, but now I'm gonna ask you this, this question, which is, can you sort of explain the role of disaster recovery and business continuity planning in terms of sort of insider threat mitigation?

So look, BCP and DRP, and they're sort of, they're interesting terms and we've grappled with them throughout my whole career because people sort of, disaster recovery planning, why is that related to IT and why is business continuity about, not about IT and so on, right? So there's, it's, there's some interesting, interesting terms that we use in this industry. Yeah. Fundamentally, BCP is about keeping the lights on for the business. So what are the business functions, processes, operations, etc.? And IT disaster recovery is really about keeping the technology running, right? So it's about networks,

communications,

systems, data access, and so on. And really, really, I guess, put quite simply, businesses put in place a whole range of different sort of mitigating controls, you know, policies, procedures, firewalls, antivirus, data loss protection, prevention, intrusion detection, etc., etc. And they're all designed to do a job to protect the organization, whether that's internally or externally. But sometimes those things fail. And sometimes if, you know, what if our defenses fail is the sort of the wording I always use. That's when we're gonna need a DRP and/or a BCP to sort of put in place. Well, you know, someone has broken into our network or that system has failed or this process can't be continued because of whatever reason, because of a, you know, an insider threat and so on. So then, you know, BCP and DRPs, but then basically that next stage of, you know, well, how do we operate now? We're compromised effectively, right? Yes. Yeah.

Is there a sort of a strategy that you would recommend that the risk posed by insiders is not overlooked as part of the overall strategy for developing a disaster recovery and a business continuity?

Look, I think fundamentally it's really about making sure that you take a top-down approach. Most organizations that we work with have an enterprise risk framework. If they don't have one, they should have. And that framework includes obviously a risk register and risk treatment plans and so on. But as we mentioned earlier, Boaz, not a lot, not a lot, not every organization has actually considered insider threats as part of that. But from a strategic perspective, I guess it's about looking at, you know, on that risk register, you know, you've got compliance risks and financial risks and technology risks, operational risks, etc., etc., legislation and whatever. But adding that category of insider risk and threat and sort of analyzing, you know, what are all those different sort of threats and scenarios that could occur from insiders? And having risk mitigation controls and plans. And then, you know, taking those, putting them on your risk matrix in terms of grid and so on, top right quadrant in the Gartner world. And you sort of say they're the most important ones. Let's develop risk treatment plans for those and have mitigation plans like, you know, DRPs, BRPs, business continuity plans, and so on.

Have you come across scenarios whereby an organization is going through some form of disaster recovery But they're being circumvented or disrupted. I'm sort of very, very— we talk about insider threats of something happened and now we've got to recover. But what about when the actual incident, the insider threat is taking at the point of time of the recovery?

Oh, so sort of a bit like looting, you mean? It's sort of—

Yeah. Well, you know, let's say you've had a situation where you've had a data breach. Now you're recovering from the data breach. But now you have someone who's intentionally trying to sabotage the recovery.

Interesting. Very interesting. Yeah. Look, I haven't, to be honest, I haven't sort of, we haven't heard case studies of that, but I'm sure there are some. But look, I guess there's some mechanisms and so on that you can put in place to mitigate against that, right? From a BCP, DRP perspective, you know, making sure in your continuity plans that, you know, confidential information is only shared on a need-to-know basis during the recovery. putting in place security and tools and methods. So you're not using publicly accessible tools and you're restricting access to particular groups. You know, you're enforcing all of the usual things like encryption, multifactor authentication, least privilege access, data loss prevention, all those sorts of things. Yeah, as I say, the analogy is a bit like a, you know, like you say, like sort of like looting during a war or riot.

Yes, exactly.

Exactly. The shop windows and steal TVs and so on, right?

So exactly. Yeah, exactly. Because that was gonna be my next question, which is basically, How do you sort of ensure that the communication collaboration during a disaster recovery or some form of continuity are secure from those that want to commit even further harm?

Well, again, I think that really comes down to making sure that, you know, people only have the access that they require, that is essentially needed, right? So there's, during a crisis, it's very much human nature to share everything with everybody.

Correct.

And when we develop crisis communication plans and strategies with our clients and we workshop this kind of thing, we often sort of say, whoa, put the brakes on here, guys. You know, we don't need to be sharing all that information outside of the organization or even outside of the command team, as we call it, you know, the executive team that's leading the crisis response. So I think really it's about making sure that the information that's disseminated to people is thought through, not just, you know, blasting out things everywhere, and particularly to those people that have privileged access, because often there's a bit of confusion in these kind of scenarios as to, is this an insider threat or is it an external cyber incident or is it just a failed upgrade or a Correct. Correct. So it's not always clear where these incidents have come from and who's behind them. So you start sharing lots of information from a, you know, during, you know, an insider threat or during an incident recovery, and potentially you can add more fuel to the fire, right?

Exactly. I think especially in times of crisis where there's a lot of pressure, there's a lot of stress, people are thinking really maybe correctly due to those situations emotionally as well, that you know, I, I think there's maybe an assumption that they're happy to share and try and make it as easy as possible. But as you said, you could be adding fuel to the fire.

And very interestingly, just on that, and it's a little bit of a side topic, but it's in those really extreme crisis situations.

Yes.

Your body has a defense mechanism and it's, I believe it's called a fugue state, F-U-G-U-E. Um, and post-9/11, for example, you know, it's so traumatic. People were being stopped in the street to, and asked their name and phone number and they couldn't actually answer that. They're going into this extreme crisis mode where your body's trying to sort of shut things down. Um, so, you know, when you go into that sort of mode, um, that's obviously, you know, you're sort of, you know, trying to sort of contain that information and, you know,

yeah. Yeah. I've often, uh, written about the flight of fright.

Mm-hmm.

Yeah. Or fight.

Yes.

Usually there's, there's a number of them and one of them is called freeze. So basically, it's the, your, well, I want to explain it into too much detail, but essentially your mind basically is not sure what to do and it's basically in a survival state.

Yeah, very much so. Yep. Yep, for sure.

So how could, how do we maybe update sort of the, the, the BCP and the DR as part of the insider threat awareness? Because I suppose on one side, and when I look at it and I say, okay, not many organizations sort of realize or are aware of the dangers coming from, from the insiders. And yet there might be on the other side where you've got organizations that are doing something about it, but are they doing it in a way where, for example, we have regular cyber awareness training? Would they do something similar with insider threat awareness and continuously update, review to see what works or not?

Yeah, I guess one of the key things is, you know, when you're running simulations, you get a lot of really useful information out of simulation testing and exercising. Obviously, real events and near misses obviously also have a, you know, a role to play. But I think, you know, learnings from post-incident reviews, whether they are Yes. Whether they're simulations or they're real, best practice around business continuity, although not always implemented, is to capture all of those actions and findings and so on out of the exercise and put them into an action register. So, you know, as well as outlining things like the scenario and the participants and the timing and, you know, what sort of what happened during the simulation, what are those prioritized actions and recommendations for improvement in terms of updating your business continuity plan, updating your disaster recovery plan, and so on? And generally, they get a lot of attention at the time you're doing the simulation because everyone's kind of in the moment and everyone really enjoys the, oh, wow, yeah, let's think about this. But what often happens is we find that, you know, ongoing, people actually sort of forget about those things. You know, they just— They fall off the radar. So it's really important to make sure that you sort of capture all those key learnings and then sort of sit down and say, right, you know, what additional technical controls do we need? What policy changes do we need? What needs to be updated in our BCP or DRP to cater for the things that we've learned you know, out of those specific, you know, out of that specific incident or near miss, right? So,

yeah. From my perspective of culture, is that, is there much talked about when you provide consulting or expert advice around organization culture and what it means for disaster recovery and BCP?

Yeah, it's, yeah. And look, it's, It often is very much the culture of the organization is always a very interesting one. You know, what we tend to find is the organizations that actually promote this from the top down, from the CEO level down and the sort of executive team and sort of absorb and, you know, take it on board and promote it and sponsor it and so on. You know, they're the ones that really have the most success in this. Trying to push it up from the sort of bottom of the organization is always a challenge. Yes. But, you know, establishing things like clear policies and procedures, you know, and reviewing them regularly. Putting in place robust training programs, promoting open communications, having a culture where employees are encouraged to speak out about different types of behavior that might be anonymous reporting systems. Some of our clients actually sort of put in place things like behavioral analytics and access monitoring and that sort of thing. Yeah. So there's lots of different ways of sort of creating that sort of culture of of, you know, awareness around different types of risks and insider threats, right?

So how do you sort of, maybe you might have seen it, how do you balance between on one side you've got trust, on the other side you've got vigilance, but you were trying to foster a culture of sort of cooperation in line with insider threats and disaster recovery because one is about Trying to get your people to do the right thing or shaping people to do the right thing. And the other thing is saying, okay, do you step, you know, do, is there some form of policy or that they might feel, well, you, you know, you're stepping over the line because you're sort of breaching my, my privacy or something like that?

It's an interesting one, isn't it? So I think, some of those things I talked about, sort of, you know, I think particularly making sure that it's led from the top of the organization. Policies and procedures often don't really sort of cut it, to be honest, in experience. It's more about capabilities and awareness and, you know, that people, you know, really sort of taking this on as opposed to sort of saying that we've got a written policy which is kind of gathering dust on the shelf, right?

Correct.

So, yeah, I think it's really important to sort of have those behavioral kind of things in the organization. Sure, you can have a policy and you can regularly audit that and you can update it and so on. But is that what people are going to do on a day-to-day basis? Correct. Rather than collaborating across teams, again, promoting that open communication where people have the opportunity to sort of have a say, report things potentially anonymously where there might be incidents occurring that they think, hey, this looks like there's something a bit untoward here, you know.

But

yes, culture in the organization of, well, you know, keep that to yourself and don't sort of, you know, don't be the whistleblower. And that's obviously going to create, you know, more friction than actually solve problems in this space. Right. And from your

observation and, you know, seeing a lot of organizations, have you noticed whereby certain maybe corporate policies haven't been followed? And is there a reason why that may be the case?

Yeah, absolutely. I think that's one of the biggest challenges with organizations, particularly from a— one of the challenges with BCPs and DR, disaster recovery and business continuity you put it into this specific context is they get very rarely used. It's not something that people enforce on a day-to-day basis.

Correct. Correct.

Corporate-level, enterprise-level disasters and crises are something that you hope never happen. Yes, correct. But at worst case, you know, maybe happen, you know, occasionally once or twice a year. There's a building outage or there's a threat from an insider around some sort of system or there's a, you know, whatever it might be. So generally, having lots of, you know, really beautifully documented plans and procedures and policies which basically don't get looked at very often.

Yeah, you got

it. It's just not gonna help. So people don't necessarily deliberately avert those policies and procedures. A lot of people don't even know they exist. That's one of the challenges, right?

That's so true.

They just don't even know that there is a policy around, you know. So again, when we're developing BCP and DRP. For example, you know, we do training, we do training programs where we, you know, we actually train people that have a role to play. So if they're a member of a response team or a disaster recovery team, you know, they get sort of trained in that role. But we also have general awareness, and it's probably 10 or 15 minutes, maybe a pre-recorded kind of video. Yes. Give this to all staff so that they're aware of, you know, basically, you know, that we have a business continuity framework. It includes things like insider threats, etc., as well as other risks. And, you know, what are the key sort of steps that they need to consider if they, if there's some sort of, you know, some sort of incident?

Yeah. Cool. Excellent. Last question. What is the key takeaway that you think regarding the topic of insider threat awareness, disaster recovery, and business continuity from your perspective?

The big thing from my perspective is organizations being aware that it is an emerging and real threat to the organization. I think that's, I mean, there's lots of things we can talk about in terms of, you know, policies and plans and testing and training, whatever. But I think the biggest thing that we see is, as I think I mentioned at the start, organizations haven't really thought about the fact that, you know, all these people are walking in the front door every day. Sure, when they joined the organization, they went through a screening process and a background check and reference checks and all the rest of it. But

it

could have been, you know, 6 months ago, it could have been 20 years ago. Who knows? That's kind of irrelevant. But they're the ones that are walking in with all this privileged access, access to confidential information. A lot of people move around organizations and keep those privileges with them. So, you know, you get moved from one department to another, but you don't necessarily get things revoked. And organizations— so people are sitting in a role with way too much access than they probably really require. And, oh, it's okay, I've got access to that. I can get you a copy of this, etc., etc. And I just, again, I just think the awareness level, particularly at these sort of, you know, from the executive level down, is at the moment is really not quite there. So I think, you know, if there's a key takeaway, it's about making organizations understand that insider threat and risk is a, is something that really needs to be incorporated in this kind of programs, right?

Oh, very much so. I totally agree with that. So, so the good thing is, you know, Ops Center, And I'll get to get you to mention a little bit about it. You know, is providing 3 specific training courses as part of the Australian Institute of Inside Australia. Do you want to sort of briefly elaborate what these 3 courses are?

Sure. So yeah, the 3 courses are basically incident response, disaster recovery planning, and business continuity planning. Obviously, some organizations, you know, call a consultant, some try to do it internally themselves. And for those that want to do that, sort of a training course and certification is a great, great path. Not everybody wants to, you know, use consulting external expertise to build these types of frameworks and programs. So the first course is really about, you know, what's the incident response? And some incidents are managed within an incident management framework, and some may lead to a disaster or a business continuity response being required. So the first and most important thing is, you know, when you discover an incident, you know, how do you respond? What are the communications? What are the team structures? What are the policies, procedures, protocols? What are the escalation paths? And so on. So that's, that's really what the incident response is about. So we, in this training course, basically help organizations to understand how to put that incident response framework together, how to assess the risks, how to assess the incidents, how to train people, test them, and so on. So that's, that's training course number 1. Training course number 2 is about disaster recovery. And again, as mentioned at the start, that's really about the recovery of technology infrastructure and applications. So if the incident gets out of control effectively, and, you know, we need to invoke that, you know, that next step, then if it's systems impacted or it's data or it's networks or it's communications protocols or it might be, then from a technology perspective, how do we recover that? Where do we recover it? What's the responsibilities and so on? And that's obviously a very complex picture these days with SaaS and cloud and on-prem and—

Yes. Yes.

Different types of networks and then people working from home. So there's, it's, there's a lot in there in terms of, and it's not really a very technically led course. The disaster recovery is really more about how to structure that overall plan and so on. What do the playbooks look like? Again, you know, what are the escalations? What do the teams look like? And so on. And then the business continuity course is really about that sort of that next level again, which is from a BCP perspective, regardless of the technology impacts, how do we actually keep our functions and processes running. So again, this course takes people through how to do a business impact analysis, how to sort of, you know, put in place plans, strategies, how to test them, how to train, and so on. So, yeah, lots of really useful information in those courses based on best practices and industry standards. We always try to align to things like ISO and NIST and all those different standards in the industry. So,

but to make it a little bit more interesting, I think these courses are sort of more tailored around the insider threat. So what could someone do Internally that, that could cause harm to the organization.

So, absolutely. That's right. Yeah. So there's a whole range of different— yeah. So these— so there are obviously a lot of generic courses out there for BCP incident response, etc. But as you say, sorry, should have made that clear. But that's, that's very much the focus is from an insider threat perspective. What are those response mechanisms are key. Obviously, we cover some of the broader ones because some people come to these courses and not understand the broader sort of gamut of what are all the different types of incidents. So we We do give people an awareness of what those different incidents may be, you know, what, what their considerations are, but then obviously drill down into those specifics around, you know, what, what does insider threat response plan look like? What does an insider threat DRP look like? And so on. Yeah. So, yeah.

Brilliant. Now, Rod, if someone wants to reach out to you directly, what, what's the best way? We can have this information with this video, but if if they want to reach out to Ops Centre, what's the best

way? So yeah, website is opcentre.com.au, and that's with the Australian spelling, T-R-E, not T-E-R.com. And you can reach me at rod.crowder@opcentre.com. You'll also find me on LinkedIn quite easily. They're probably the 2 easiest ways to get in touch with us.

Yeah. Cool. Well, I hope you liked our discussion and—

Absolutely.

Thank you for, you know, joining us. I really appreciate it.

Thanks for the opportunity. I really appreciate it. Again, I think it's a, it's a, it's a really key area which, um, you know, we, we're seeing a lot of growing interest in and, you know, probably, as I say, quite, quite a lot of misunderstandings. So I think it's a really timely, timely topic to be talking about and, uh, raising the importance and awareness, um, you know, with, with, um, yeah, the corporate world and, and government and so on as well. So yeah, thanks for the opportunity to—

I totally agree. Yeah, I totally agree with what you just said. So yes, it's become Very topical. Thank you again, Rod. We will chat with you soon. Sure. All the best.

Thank you.

See you soon.

We sure will. Thank you. Thank you.