The Mystery Of The Insider Threat Type REVEALED

Now once again everyone, this is episode two of the Virtual Pub. I've got Shauna Fear with me and it's a beautiful day in camera. So that's good. No comments on the side there. Today we've got an action packed full of information and lots of value about the different insider threat types. And importantly, we're going to reveal right towards the end what is that secret that no one talks about, that no one knows what type of insider threat that is. So we're going to talk about that. But force first. First, first, first. What beers did you bring along, dear? Well made.

This time I'm sticking to my iron Jack. It's beautiful. And yeah, well, let's wait for everybody to open it.

Yeah. And I've got this is a very typical Belgian beer. It's called a Creek. And what makes it really unique is its cherries. It's a cherry beer. Yes. And it's red, purple inside. Yeah, so. So it's been like a wheat beer but with cherries. So that should be really interesting. Anyway, so what I wanted to do. So I want to start off with a story and you're probably wondering, what the hell is this thing behind my back and why have I got a bulb and why have I got disconnected? Now that might already raise some additions and you might get it. So let me tell you the story. So three months ago, or probably a bit more, I ordered a couple of these video lighting systems. So they're special, these are fluorescent bulbs and they arrived I think just beginning of January and I didn't pay attention. I just left it in the office. And a few weeks ago they said, oh, you know what, I should really pack it up, I should really, you know, get it sorted. So here I am, you know, configuring, standing it up, fixing the the bulbs.

Let me test it.

So I put it on the system and suddenly I hear this sound and within a few seconds was, it smells really, really bad. So I switched it off and I was thinking, what the hell happened here? I mean I did everything correct. What's going on? So I waited for it to cool down and I sort of took one of these off and I could hear making sound and I could smell it. And so I started to read and I'm going, okay. Oh, it says 110 to 130 volts. And in Australia we have 240 volts. So no wonder these light bulbs got fried. So that got me thinking. I made an assumption that because I ordered it and plugged it in that it should work. Fine. That's just how humans behave. We make assumptions because we tend to make a claim without an evidence based around it. So basically, when you wake up in the morning, assume it's going to be nice and sunny or there's going to be light. When you drive on the road, you assume that no one's going to drive on your side of the road against you. When you come to a traffic light, you assume, well, red means to stop and green means to go. When someone turns, you expect them to indicate. So we have an assumption base. Taking an example, when you go to a doctor, you assume that they have certifications and credibility. You don't go and ask them, prove me that you are a doctor, that you're capable of doctor, you've already made an assumption that he's capable in the same manner than when we go into a plane, we assume that the pilot knows how to fly the plane. So assumption can be good because it cuts corners, but it can also be bad because we make an ass of you and me, which basically means what are the things that we do in business that could put ourselves in jeopardy? Or what could we do in business that by the very actions, whether the intention or unintentional, could put the business in harm? So this is what I wanted to start with, and I'll let you guess what type of insider threat type that is. But we'll talk about it and we will get there. So today's topic is uncovering different types of insider threats. And Sean, just before I get you to start a story, maybe we start off with what are some of the malicious. We'll sort of describe the three different types of malicious insider threats that everyone is aware of and then we will describe the unintentional. So let's start with. Well, actually, do you have a story to tell to start off with or shall we tell the story when we describe the different type of insider threat types?

Yeah, so. Well, insider threats are barriers and we all assume that we know all of them. And when you say the word, when you mention inside the threat, everybody thinks of the malicious people, the people that steal the data, people that sneak in during the night and steal computers and documents, or espionage, etc. But these are the common assumptions. Insider threats are basically people that put the organization in a risk and any type of risk. So whether they are good people or bad people, whether they have intentions or not. Well, I can tell a story of the. That nurse. Remember that story with that nurse?

Yeah, yep.

Yeah, with David Beckham. So, yeah, that nurse in the UK she was a big fan of David Beckham and when he was admitted to hospital, she was sitting at admission desk and the moment she saw him, well obviously she recognized him and she was so overwhelmed. She's looking at her idol, obviously he was good looking. And she said, well I can, I can actually get the opportunity now to know his phone number, his address because he was have to. He was admitted to hospital.

Correct.

So after he was admitted she was so she had, she was so overwhelmed, she texted to her daughter and she said, Jenny, you won't believe who was just admitted now to hospital. And she took a screenshot, the computer of the, you know, hospital computer from the system and she sent it to her. She said, you won't believe this is David Beckham. And then she started the snowball because that daughter wanted to share that secret with her friends and started to spread and eventually there was an investigation how data leaked, etc. So I won't tell the type of that insider threat, but obviously it is an insider. She had accident and something happened there. So I'll let you start and describe the, you know, the typical insiders and then we'll get to the secret one that everybody.

So from a perspective of insider threat, intentional what it is, we have a person through their actions that causes harm to the confidential integrity and availability of that asset. That's really the definition, the negative consequences. So let's have a look at the first one which is called insider threat sabotage. So that happens when a person through traditionally what happens is disgruntled and I'll explain maybe the steps before that. A disgruntled person decides to seek revenge or has a grudge or has some intention of causing harm to the organization. So could be maybe a person that decides to delete information on purpose. So it could be like database. It could be maybe he's written what is called a logic bomb. So it's like some software that will detonate and will cause harm to the organization. Or you could say, look, I'm going to take this data and I'm going to post it up to the web so anyone can actually see this classified information. So this is basically an intentional harm causing some disruption to the organization in one way or another. I mentioned about logic bomb. Think of maybe even a person that could render the system so it's not accessible. We had a client like that in Sydney who was an IT administrator and to make himself look really valuable and needed the system would unexpectedly and unexplainedly go down and they would call him and Say, look, our system has gone down. He would come there being the savior, and they loved him for that. So the question is, why did the system go down in the first place? And that's the same story.

These fire firefighters, one of the firefighters here in nearby in Tarahumara, he lit fires during the fire season just to be presented as brave, and called his guys, let's go and kill that fire. But he lit that for the first place. So another good example.

Yeah, exactly. What's interesting about that, that the person that is motivated to commit sabotage is usually a person that has. Well, a lot of the studies have looked at the type of people that actually do it. They've worked out that typically, most of the time is that person has had what we just call is personal disposition. So they've got some issues, whether they've got some melting hills, you know, they've got some drug habits, they're going through a divorce, they got some internal challenges that they're going through. And what's happening at work just set them up. So it's a trigger. So it could be like an unmet expectation. So maybe they didn't get their bonus, or they didn't get the raise, or they didn't get the promotion, or they didn't get something that made them feel that, geez, I got to take it against the organization. The other interesting thing is usually this type of attack happens pretty much when the person leaves organization or about to leave or post or has just left. So that's quite an interesting situation. I was going to say that we're not really going to talk about the mitigation part. We're just going to talk about the threat types and anything that you wanted to add there, Sean?

Yeah, I guess I wanted to give another example of a true story. A friend of mine. A friend of mine was a part of three. It was part of a team of three that they were constructed by one of the big four consulting companies to implement the payroll system. Now, while they were sitting there, one of his colleagues, he had access to the payroll list. So he downloaded that. Well, because he could he download that list. And he surprised my friend with a question. Dave, why do you earn more than me? And my friend was really embarrassed and didn't know what to do. But that guy, actually, because he had the access to that data, he downloaded now he had that list with him, what he had also marriage problem and drinking problem. So all together came up to a big frustration that led him, that's what I've heard after, to put that list on the dark web. So collaborate with a hacker that tried to contact the CEO of that company and blackmail them so they could share the money. I can tell the rest of the story in another occasion, but. Yeah, but that's another example.

Yeah, pretty much.

They assume to be good.

Yes, Correct, Correct. So the next type of insider threat is what we call ipsift or data theft. We tend, I think most organizations tend to think that people steal information or an asset of an organization because they want to sell it. It's actually slightly different. Most people that when they steal data or steal ip, they do because they either want to take it to the next job, they want to use it as an advantage for themselves, or they could also start their own business using that information they've stolen. Or, you know, from an espionage sake, they could take it to a foreign country. What we've seen that most data sets have taken place and I love the saying data doesn't walk out the door by itself. Over 70% have already access to the data. So that's quite interesting just to get our head around it, that we put bucket loads of money around protections and you say very well. Deshaun about firewalls and intrusion protections and antivirus and so forth and so forth. And yet the person has got access to it and they walk out of the door. Harold Martin from NSA did it for 25 years taking classified data. So there's an organization with unlimited budget security and yet he was able to walk out the door quite easily. The interesting fact about data theft is that it happens usually just before they leave the organization or just after when they leave an organization. So even though we're not talking about mitigation for an organization, this is probably the most critical point of time. We had an example last year, you remember, through one of the vendors that told us the story about amp, A Chinese person working for AMP basically had connection with another person who managed to download him some, I think was like 25 records. We're not talking about a lot of. Yeah. And he basically was caught boarding the plane going back to China. From what I get up. So these things do happen. Is there anything that you want to sort of mention about that?

You remember the Tesla incident when the Tesla blueprints.

Yeah, yes. Yep. Yeah.

So, you know, when people have the access. This is the problem when we talk about, you know, a computer will not decide by itself to do something. But when we talk about people and we always emphasize we're talking about people here. So a lot of factors or elements with human behavior Are really not. They cannot be expected or they are very dynamic and can change every day. So you cannot really predict what people will do. Well, actually we can predict. It's another subject, one of our future sessions. When people identify or when people come across an opportunity, it's a junction where they need to take a decision. It is a decisional junction.

Okay.

Whether they say, well, we are not supposed to touch that information, it's not for us. Or they say, wow, it has some value, we can keep it, maybe we can use it in the future. It's like an insurance. It's like you said, might have an advantage. Or they say, well, I thought about that leaving the organization for quite some time. Now I have something that I can use that can help me to promote the idea of or can paint me in a very good color with the competitors. So this is what I call a tipping point.

And.

The ability to catch, identify and mitigate in that tipping point, even before what is leading to that tipping point to predict. That's the ability that we help to develop with our clients. Yeah, right.

Well said there. So the next type is quite well known and we probably see quite a bit. I think there's been quite a bit of rise of it during this period. It's called insider fraud. Now insider fraud is quite difficult to catch because usually these type of attacks happen doing business out predominantly happens doing business out. But the most important thing is these people have already trust and they have access to that resource. So defining what insider fraud is is basically someone that has ability to an organizational resource that can either modify or change the data. So basically what they do is they use that information for personal gain. As I said, most, most of these attacks, over 75% happens during business hours and the rest from outside. So what causes someone to commit inside a fraud? And usually there's three. It's called the fraud triangle. So basically what happens is typically a person has some form of pressure. So in this case, maybe they've got money pressures which could be happening right now, given what the situation is happening. So there's some personal disposition that they're going through. Then there is an opportunity. Now opportunity means that they have access to some resource because they're in that position. Okay, so think of a payroll office. They've got access to the payroll system. Now, whether they should or can do it's a different question. But then comes the last point. It's the motivation. So what motivates them to suddenly realize, okay, I've got this pressure that I need to find some Money. Here's the motivation, and this is the way I'm going to execute it, because I've got access to certain information. So here are some examples. A loan officer providing the ability for people to get easy loans, for example, without the authorization because he or she can actually authorize it. Or for example, a police officer that. And this happened in the United States, an operational police officer was able to grant 195 driver's license without authorization. So in this case, there was no checks and balances to say whether you can or can't do it. So because he had the ability to do it, he, he could do it without anyone authorizing him. That's a typical example. Now, the key thing is most of these people that commit fraud tend to be either admin clerks, low level people, or managers. And so we tend to trust managers because of their role and authority that they have. And we tend to trust low level clerics because we tend to think they don't have access to sensitive data, which is quite interesting. Now, typically there was a study done that basically people that commit fraud, usually they were within an organization for about five years, and then because of that such great trust they have, they can commit for another 18 months or thereafter fraud that no one is actually paying attention. In fact, it's only when someone decides to do an audit of the organization that they find out something has happened. We had a case in New South Wales where I'm just trying to see whether it was an educational system. The IT manager created a fictitious company. And basically he as an IT manager sent procurements to himself, to that fictitious company. This fictitious company then procured the technology and then invoiced that organization without any checks or balance. No one actually checked. And I think he basically defaulted over a million dollars within a space of two or three years. I can't really remember the actual name, but these things happen. Sean, your thoughts?

There was a woman in Israel, I think it was 10 years ago, something like that. Her brother got involved with, you know, the gray market. You know, he took loans, he was involved with a lot of gamblings, and he was. He owed a lot of money to very bad people. They actually threatened his life and his family life. So she was working in a bank. She was a small, not really important account manager for a business account bank. So it was mainly managing business accounts. Now, she was very trusted and the account owners usually called her once a month to get statements and to understand what's going on with their account. Now, what she did, she was initially, because she knew the processes really well, she wasn't any manager. She was nothing there. She was just managing transactions and issuing statements. But she knew the processes. So over three years she was rounding down all the transactions to her brother. So when the account owners asked for statements, they got a very good statement showing them that they have the money and the money is growing, etc. But in fact, she drained the bank completely from money and the bank collapsed within three days. Collapse, wow. Totally. And there is no money. There wasn't any money.

It was over.

25 billion. Something insane. She drained the entire bank from its money. That's because. And she did that fraudulent act. But she was very sophisticated not to be alerted because they trusted her and she knew the processes. So when you talk about people that commit fraud, these are not people that new to the organization. Usually people that commit fraud are people that know the organization's processes and limits and restrictions very well. They know how to bypass controls without being seen, correct?

Very much. Spot on. There's a good documentary on Netflix about. Jeez. And I can't remember the program, but I'll put it in the link. It goes for about 50 minutes, I believe. And it talks about a lady in the US who is a manager of an organization and what she managed to do and how she managed to get away and she defrauded the organization considerably. Very interesting documentary. So I suggest you check it out. So those are the three key known insider threat from an intentional or malicious point of view. So the one other one that we haven't talked about is the unintentional. Now, most organizations or most people think that unintentional is basically someone that is negligent. So I'm actually going to split into two because this is quite a bit of revelation. Now those. When you seem to find unintentional, there are those people who are good, who follow policies, are knowledgeable, but execute badly. So they're poor in that moment. They don't follow it. Okay, so there are reasons. Could be because they're stressed and they have an important urgent assignment to do. So they will find a way to cut corners. So for example, they got a report that's due tomorrow. They have to hand it to the CEO. He's now sitting in the office. It's seven or eight o' clock in the evening. He's got to get back, he's got to feed the kids and so forth. So what he decides to do that, he copies the data on his USB or he posts the data onto the Dropbox onto some other cloud box. And that might be against the corporate policy. Now he's not mean, he wasn't doing it just in spite against organization. He was just finding a way that he could still be able to work from home and complete the project that he had to do the report for the CEO the following day. Now there is also the other side we call ignorance, which is basically someone that doesn't follow policies and control and also is a poor actor. So let me give you a situation. Have you come across people that no matter what you do from a training perspective or policy perspective, just don't follow? They're just not interested. And that's probably because they might say, well, given my managers don't follow policies, why should I follow policies? Or this is just too complicated, this set of corporate policies, just too complicated, I can't understand it and it's too much of it. Or they're so disengaged they don't care. So one case is they don't care about the organization. Another case they are sort of negligent. So negligent could be another situation whereby I open up an attachment that happens to be a malicious, I click on a link that happens to be a malicious and allow an external party to become an insider. Okay, now both case, it's non malicious and it's unintentional. So the big difference between the malicious and unintentional is intention. One doesn't have any intent on the situation. Sean, your comments. Yeah.

You know, the intention, that's the most difficult thing to identify. And that's the problem. Now it's funny because if you remember that Martin guy, you know, the deceased of that law firm that we met just before the Corona told us about that case where one of the lawyers, actually Sina1 wanted to take the, you know, the case with him back home and their printer didn't work.

So guess what he.

Well, remember what he did? He emailed the case, very sensitive case, to his wife and called her, asked her to print that case and bring it back home. And guess what? She forgot to bring it from the printer. So the entire sensitive case was lying there during the entire weekend and they found it. Well, one of the housekeeping staff found that printing it was just lying on the printer. You know, they could read the first page easily and they saw who printed that, so they just put it on her desk. But the fact that such sensitive data was exposed, well, it doesn't mean that that lawyer is dumb. Obviously not. He's a lawyer, well respected. But he knew that data can't Fly outside the organization. He did that with no malicious intent, just. Well, I think it was a combination of ignorance, negligence and carelessness altogether.

Yes, correct. So what we have there is the unintentional and we got unintentional. So what we want to do now is reveal another insider's risk type that no one is talking about. But it happens a lot. And I start off with a very simple example that a lot of the organizations are doing today. So for example, a lot of organizations doing today are cyber awareness training. So one of them would be a phishing test. So what they do is they send a phishing email that looks like, well, it's a real example. And they want to see whether people actually enter their details, their credentials. Now imagine the situation whereby the CEO has entered their login credentials. Now have a thinking about that. So from a point of view this is not malicious. But now the people are doing the assessment have got access to that information, to the CEO's credentials. That's one of them. Now another example, again it's not malicious. But imagine an administrator, we tend to think that superpowers the most dangerous type of user, but they can be when a person decides to eavesdrop on someone's email so they can actually have access. Well an IT administrator or manager can access anyone's mailbox and they can look at that email. Now Sean, you talk about can and should.

Correct?

Correct.

So I'll give the example before we all remember we to remember that companies EA, the CEOs EA that was typing the board meeting summary where they discussed the trend of the company's shares and the next steps and that was a very sensitive discussion that could easily impact the shares value in the market. And when she was exposed to that, although she was just the ea, she assumed that those shares might rise in their value and she advised her colleagues to buy those shares. Now I always say that when you define what's the fine line between, you know that define inside the thread. I always say it's a very fine line between people, what they should do or what they can do and employees and people today in general. They are encouraged to think outside the box and be creative and solve problems. But they are under a constant stress of in one hand to follow the policies and the rules and obey. But on the other hand they need to perform. And sometimes when people put in that situation, they tend to do what they can do and not always what they supposed to do, what they should do. And this is the fine line, this is actually a tipping point where someone Says, well, I have that piece of information, I can use it. He's not supposed to use it. He has access to very sensitive data. For example, those guys with a payroll, it could be devastating if that payroll lease could actually access and distribute it to the entire organization. Could be fatal impact. But the fact that he could access it doesn't mean that he should use it. So that's, I think, the fine line. And what I think what we always pitch to CEOs and board members, you need to look at your population, your people and define what they should do versus what they can do. And this is where you can identify whether they become, whether they cross to the other side.

That's a very good point. So this type of insider threat is defined as being misused. So think of it as a situation where the person has got unauthorized. Well, they have authorized access, but they're actually unauthorizing their actions on that point of tide. That is a benefit to them rather than the organization. So similar, I know I've been approached by one of the government departments and they told me, look, we've got people accessing very sensitive database. They're authorized to access it, but how do we know when they're snooping around, when they're doing something that they shouldn't be doing? And that makes it very, very difficult. And we talk about it a lot. So that type of insider threat is not even talked, but it happens a lot because we have people that. For example, I remember once working at a government department where there was a guy that constantly roamed around our office looking for information. He would come and look at your screen, he would want to know what information you have on the screen, whether have you got any notepads or what have you written. And he would just constantly be buzzing around every day. And that type of person said, well, hold on, why is he doing it? And his role was to get information. So just like you mentioned about that person who managed to get access to the financial wages of the whole organization, now he took it to the next stage, but you know, people do it. The insider threat misuse is a situation where the benefit is to themselves. There's intent, but there's no harm to the organization by and large. So they haven't sabotaged the organization, they haven't stolen any data, and they haven't defrauded the organization, but they have used that information for personal benefit or from a curiosity point of view, so that can be used down the track.

Look, when a baby is looking at the electricity socket and he wants to push his finger there. He's curious. But if you don't stop it in time, there is a problem. So this is a risk. A risk sometimes starts when there is a very early intent before it becomes. People become inside. The risks before themselves, before they become an inside risk of the organization. All starts with a thought, one single bad thought that can lead to bad consequences. So the misuse is that the one that he can be very trusted, he can be very loyal, he can be a very good employee with a very good future. The problem is that when, when an opportunity is sitting in front of their eyes. As I said, we are all human and we need to identify that, that tipping point and to stop it before. Before it become critical.

Correct, Correct. Correct. Now, the interesting thing is when we look at insiders trade, by and large, we tend, again, you know, it's just the perception that it, it looks like as if it's malicious, but around 70% of it is unintentional. But there's no, there's no real percentage in terms of misuse, but it could be considered as part malicious and part unintentional. So, Sean, look, just in closing the remarks, what is the one thing that you probably, you would recommend people watching this, this video that they should focus on or do once they get back to the office of Business? Yeah, so.

Well, especially in these times, when we come back from this devastating COVID 19 period, people will come to work, whoever joined, come back to work with a lot of uncertainties, with a lot of fears and probably with a lot of stress. They will get that stress from the organization. Now stress is for. My concern is number one cause for insider threats because stress can lead to mistakes, sometimes to bad judgment. And those people will tend to do mistakes. People will tend to do mistakes. People will start to look around to see how will they impact it. And I would recommend to any CEO today to look at people to monitor their activity and understand how they get back to work, trying also to teach them and train them and encourage them.

To do the right things and give.

Them a lot of positive, you know, injections so they will act right and basically help them to get, you know, smooth back to work. But it's very important to look at people at this stage.

I would totally agree. I think, as I mentioned it last time in the previous session, that we're going to look at people as individual beings rather than being robots. We tend to set these policies and controls and we expect people to do the right thing and we give them trust. We expect them to behave in a certain way. Yet I think we also got to be, and we just talked right at the beginning, don't trust but verify. It's funny, I mean example, like if someone's handing out the weekly hours that they've done, should the accountant or the payroll officer check it? Sometimes something like that, you may say, okay, well look, I trust that person. But I think as an organization we sort of realize that we're not robots, we're not systems, we're individual people. And that different types of insider threat types happen. Not because we're looking at systems, but we have different people that, you know, that go through a certain situation in their life, they're motivated and cause something and organizations got to realize that. Or is it because the mistakes that they've made, whether unintentionally from a negligence point of view or from an ignorant point of view that's causing could potentially put the organization at harm. And I think the organization has got to think about and just to say, well we're not going to put another firewall, but that's not going to solve the problem because we're talking about behavior. So the key part here is that I think what I like businesses started realizing people have behaviors and they're dynamic and they change depending on the circumstance. Which is exactly what you said about the COVID situation. So basically that concludes the presentation. Sean, sort of. Any last remarks that you want to say? Yeah.

So thanks everybody for joining and don't forget to subscribe to click the subscribe button below so we can get more, you can get more updates from us and we will be probably coming again in two weeks time, right?

Yes. I think the next subject is going to be about COVID So it's going to be about has insider risk increased as a result of the pandemic situation? So going to be more of a discussion, general discussion. I think it's going to be held on the 4th of June, either 3 or 4 o' clock in the afternoon. So we'll notify that. Yeah. The other thing is if you haven't got this book, it's free, you can download it. I'll put, put a link to it. This is like an insider Strip 101. This is great way to get your head around it. That's a book that I wrote a couple of years ago. So yeah, please download it. As I said, it's free. If you want a physical copy, let me know and I'll sign it and I'll send you a copy. But you'll have to give me your address and details and so forth. So with that, I'm going to wish everyone a happy Thursday. Just stay tuned to the next session. We'll, we'll send out emails and, and then on LinkedIn. And if you want to see replay of this video, it's going to be on the Sabassi YouTube channel. And with that, I'm going to wish you cheers. Good to see you.