Why The Coronavirus Epidemic Has Increased Insider Risk?

Okay, welcome everyone to episode number three. Glad that everyone brought their drink along. That's the most important for Thursday afternoon with the virtual pub. Today's subject is actually quite topical because we're dealing with insider risk and the coronavirus. And the question is that we pose is, is the coronavirus or does the coronavirus increase the risk of, of insider risk? So that's the main topic, but we've got the big elephant in the room to reveal at the end. So you know, stay, stay around and watch. But before we get into this topic, which is really interesting and it's quite packed, we just sort of maybe talk about some news that happened over the last two weeks, won't we Sean? Yeah, I think we got a good idea. So.

But just sort of go ahead, sorry.

Just to start, you know, warm the appetite to see what, what are the risks and what, what are we seeing out there? So I sort of did a list of a number of interesting stories and one of them is the Toll Group. And what's interesting about that one is it's been hacked again for the second time. It's basically ransomed. From what I get, it's about 200 gigs of data being stolen. And the question is, why did it happen for the second time? Now my own interpretation will look at basically that Toll Group weren't able to clean the malware effectively in the first place. So there could have been some remnants of it still being there. Richard, you've got some thoughts about that?

My understanding is it was a different crew.

Yeah.

So it's less likely to have been remnant. An issue of non cleanup. It's more likely to have been an issue of oh, these mugs. These mugs are an easy target.

Let's go and give them a go. Correct. And there was a similar situation with actually a male equipment manufacturer called Pitney Bows. They're based in the US that's $3.2 billion company. Also in the last eight weeks, twice they've been hit with ransomware. So that is quite interesting from an insider threat perspective. We've got a quite interesting story. We've got a, a former IT administrator of an Atlantic based building production distribution company. This person basically resigned and he changed the passwords on the routers and basically caused some damage on some of the systems. He actually brought them down and it cost the organization $800,000 of damage now. So from what it looks like the company that he worked for basically got bought a few years ago or got bored recently. I'm not sure about that. And he didn't get on well with his owners and he decided to walk away and cause some damage. Another insider risk we see actually is just around the corner from where we are in Victoria working as a project manager and he basically diverted $14 million worth of contracts to his own company. So when he joined the Victorian government, he didn't actually declare that he has a business on the side and he was influencing a lot of processes to move these contracts to his own business. And he worked for 13 years. So, Sean, I see last time you mentioned that, you know, fraud usually is a long term commitment and people are really trustworthy and so forth. So These are the two insider threats that I saw in the last two weeks. Other stories, we've got EasyJet being sued for $8 billion because they leaked, you know, $8 million of records. That's pretty bad. We've got the, the number one Thai telecommunication carrier leaking 8 billion records of information. So the danger with that one is because it's from a telecommunication, they have taps on every mobile, every system. And what, they're afraid that journalists and activists could be targeted because in Thailand they have very strict laws in terms of making any comments about the royal family. So that's not good. And last but not least, we've got Google in the news for a lawsuit of $5 billion because of tracking private browsing. So that's very interesting. Sean, have you got anything that you want to share? Yeah, we.

One of the things I heard on the news recently and I don't know. Well, it was spoken everywhere, it was the attack from Iran on the critical water infrastructure of Israel. So basically they tried to hack those systems and increase the level of chlorine in the water to basically poison citizens. Unfortunately, it was identified in time and was mitigated properly. And in return after a week, it was funny how the Israelis stopped the entire activity of one of the biggest ports in the Persian Gulf so they couldn't really get ships, you know, transport ships into the port for almost a week. And obviously, of course, everybody are witnessing the terrible, you know, impact of the devastating incident in the US Where a cup, a cup that's supposed to protect the population, protect the citizens, need to obey the rules and the etiquette of the police, just kill the man, murder the man in front of cameras. And apparently it wasn't the first time he was accused in violence, but nobody really paid attention to that bad behavior that he had before. And it was just repeatable and this time it was with unfortunately tragic, you know, results. So, and we see now the riots of all the black people in the States, you know, crying for, you know, to be equal. And it shows again what's happening in the States. And the racism is coming back again. It's terrible. So we see how one person can lead to a total chaos within days.

I've got also feeling that because of what the environment is, it was like another match to the fire. It was like another kerosene to the fire because of what we're going through. Covid and this basically brings me to the topic and the question is, you know, because of coronavirus, because of the epidemic that we're going through, has that increased the risk of threats from within? So I want to make it a little bit different. Discussion. We'll play a little game. Sean, and the game is I want you to be the chief financial officer of an organization. What do you think has changed between before the coronavirus and now from your perspective as being the cfo?

Yeah, so assuming that I'm running an organization with couple of maybe a few hundreds or few thousands of employees, and maybe it's a distributed organization, I'm in charge of the entire financial activity for the organization. And normally my activity is quite observed, monitored, and, and I'm in charge of one of the most critical assets of the organization, finance. So, you know, on a normal day, on a normal day, when people coming to work, they contribute with their, of course, the work to operate the organization. And at the end of the month, we run all the payroll process. I'm in charge. I have a team that's in charge of payroll officers and administrators and secretaries. And we address all the payroll paychecks, salaries, questions, tax deductions, bonuses, commissions and everything, expenses, etc. But I have also the visibility. I see the people, they hand the forms, I can question them, I can talk with them, I can see them. Now, these days we still pay for employees, but I don't see them. I don't know whether they are doing, whether they work and they're doing what they are expected to or not. But also from my perspective, when I come to work, I have access to sensitive systems such as the payroll system I have. I'm in charge and sign on all the transactions of the corporate business, bank accounts. I have visibility on the shares, I write the reports, I Talk with the CEOs and the management almost every day. I'm preparing reports for the board meetings. And now it's hopeless. I mean, I'm sitting at home, I need to access all these systems remotely. And it's funny, when I'M at work. They expect me to follow regulation compliance policies, a lot of controls that are in place and. And we actually even did a drill, a real drill how we move from our facility to another facility, a disaster recovery one. And the company and I was involved in that project. We invested a lot in creating another doctor site. So if something happened here, we go there. Now the funny part in this whole COVID 19 pandemic is that our homes, individual homes, became the doctor so employees are sitting at home now accessing the corporate systems and the sensitive systems from home using unsecured line. We have a lot of destruction at home, right? Kids running, wife is talking. Wife is a big problem and.

I.

Can personally justify that. I made mistakes. I made mistakes and fortunately I managed to remediate them on time. But it could be devastating. I had to approve some processes that normally I need to verify now I don't have the visibility. So yeah, it's something. And you know what? Now I'll speak, I'll talk about a different cfo. I can damage now to organization because I have access to those systems that nobody pay attention, nobody know what I'm doing with those systems. And now I can do things that normally I'm not expected to do, but I still have the privilege. So this is what. Well, I guess you boss can. Can define how. What's what. What is my definition now?

Well, I was going to say, I was going to add it's a great time to be a malicious insider.

Absolutely, absolutely. Look, I'm loyal to the organization but I from my seat at home, I. I started to think about key positions or people that can hold the keys of our crown jewels. I started to fear. I had some discussions with the boss, with the CEO.

If you have someone who has some ill will already to the organization, they are in a control environment internally people can see what they do from a policy, from a process to what they can access. Now I'm physically separated, I'm working from home. I'm emotionally separated because you know I can do whatever I want. And because I still have access to sensitive assets, I can commit the incident without anyone really paying attention. It's so much easier because there's so much confusion and so much more chaos. So that brings me to the next point. Now imagine if you are the HR manager, what are the challenges you think are facing because of the epidemic.

It's funny as an HR manager.

It'S.

Funny and I feel a bit ashamed to admit that I usually administrate people and what we do in The HR department, we manage the list of the paid people, the payroll we do, we administrate the employees, we do the interviews, we hire, we fire, we set all the documents. But it's for me as an HR manager and I think I'm very good at that. I usually travel between the people and I invite people to discussions and I talk to people to understand how they feel within the organization. If they are satisfied, I talk to them. If they have a problem with their boss or manager, right now I don't have access to my responsibility.

Yeah, correct.

I don't have access as an hr, I could actually get reports by people that looking at the colleagues or I could get the feedback from employees of how they act. Today I have no visibility.

Correct, correct. There's such a, a physical separation. So what do you think of the challenges for the, you know, traditional Chief Information Security Officer in terms of looking after all the people that are connected to their business?

I have a mattress protector as a ciso, because every day I wake up and I check my mattress. If it's wet, I can tell you. I can tell you that, mate. Because as the Chief Information Security Officer, my job, well, this actually was written in my contract. My responsibility is to take care of the information security, make sure that the information and the critical assets as the organization define them, the data, the ip, the infrastructure, I need to make sure that all safe and working and there's no under threat. So. But these days at work, I make sure that everybody connect properly, they have the right controls. I control of what they can do or should do. I block what they don't need to do. I monitor the systems, I get the logs from systems and I also look at my staff who has access to many sensitive infrastructure and, you know, and data. But as a CISO that's sitting at home, I don't know, I'm relying on system logs, I rely on reports. I don't see the stuff. But it's more than that. And I think now I'll wear the head of all of the HR and also the cfo, and I'll talk as a corporate executive. The problem now for my employees and also for me, by the way, because we see the news, we hear the news every day. We get a lot of. We get stressed, we get stressed. We see what happened to Qantas, we see what happened to banks, we see what happened to our large organizations that they lay off, you know, let off many employees.

Qantas are around 20,000.

A lot of uncertainty is built up now and nobody Gives answers and we see what happens in the world. So look, I am as a CFO or as an HR or as a ciso, well, I have enough oxygen for bad days. But I think of my employees, those employees that live on salary and if they don't have the monthly salary and you know, my colleagues, my peers, they have mortgages, they have medical expenses, they have other commitments. And I think if I can't pay my employees, it's a problem. There is a lot of emotional stress. And usually emotional stress drive people to do mistakes and drive people to. Well, it's basically switch them to a surviving mode. And when you are in a surviving mode, you will do everything to survive. Now my worry is what the people that I gave the trust them and I gave them my trust and I gave them the keys to our crown jewels. What can they do if they are not happy?

Right? And I see that really comes down to. Because we have, you know, employees, including the management and executive, all locked at home. The question is now where's the data? So what I see and what is being reported? That because of stress and the uncertainty of the world and so forth, people tend to make more mistakes. So as we often talk, data doesn't walk by itself, but data can walk out of the door if you intentionally, unintentionally, you know, do something. So there's a lot of report from, you know, data being mishandled. Organizations don't know where it is, how to protect it. You know, before everyone was in a physical environment. Now everyone is dispersed. And I'm reading a lot of reports about, for example, espionage, which is just another, for another section of data exfiltration. And we see that specifically between the two superpowers. Now I'm talking about China and the US Lately I've read a number of reports whereby the US have been arresting a lot of Chinese. They've seen a lot of attacks on medical facilities to do with Corona IP intellectual property there. The core wall is building, let me, let me put it that way. And there's been also a lot of recruiting going on in terms of how do we get hold of this data so we can take it out. So we see that a lot in the news. Now the thing I was going to ask you, now you are the compliance officer within our organizations. We know there are standards, we talk about ISA standards in federal government. You got the isam, you know, with banks and you got the pci, you got the, you know, with health, you got the HIPAA and so forth. Given that.