Abstract:
An organization's risk due to insider cyber attacks depends on the complex interaction of the organization's business policies and procedures, organizational culture, and technology over time.
Mitigation of that risk cannot be accomplished in isolation; it requires planning, communication, and interaction between the organization's management, human resources, and information technology departments.
In collaboration with the U.S. Secret Service and the U.S. Department of Defense, the CERT Insider Threat Team, composed of both technical and psychological experts, has gathered and analyzed over 200 insider threat cases, including cases of IT sabotage, fraud, theft of sensitive or proprietary information, and espionage.
This presentation will focus on one type of threat that can affect any organization - insider IT sabotage.
The MERIT model for Management and Education of the Risks of Insider Threat, developed by CERT/CyLab, will be used to demonstrate the "big picture" of the risk insider threat, including
* the interaction of policies, practices, technology, organizational culture, and insider psychological issues,
* the escalation of the insider threat problem over time, and
* key countermeasures to mitigate insider IT sabotage.
The model will be reinforced by descriptions of actual IT sabotage cases, and the presentation will conclude with a list of 13 best practices for the prevention and detection of all insider threats, to include fraud, theft of confidential and proprietary information, and IT sabotage.
