-: Insider threat.
What is an insider threat?
In my opinion, an insider threat is probably one
of the worst and most dangerous things
to your organization.
An insider threat is simply somebody who works
for your organization, but they have ulterior motives
and they want to do something negative to your organization.
For example, let's say that I hired you on
to be my employee and you decide to come work for me.
The first thing I'm going to do is give you account access.
So I give you a username and password.
Now your a standard user, but you can log on to our network,
you can access our files and our shared drive,
the ones that you have permissions to,
and you can send emails and you can go on the web
and those type of things, right?
Well, let's say that you build up trust
in my organization for about three to six months
and I give you more and more access to different things
throughout our organization that you need access to.
You have access to maybe all of our slide decks
and all of our videos and all that kind of stuff.
Well, if you took all that data, copied it for yourself
and then gave it to my competitors,
you would be an insider threat in that case, right?
Because you've stolen the information from us
and given it out to other people.
That is why insiders are so dangerous,
because they're hard to detect,
because they already have authorized permissions
on the network to access those files and folders.
Now, if you're an insider threat,
you might also decide to download something
like a key logger or some kind of malicious software
that can go around and collect data throughout the network.
Again, as somebody who is authenticated and trusted
on the inside of the network,
we're not necessarily looking for you,
we're looking for bad guys trying
to break in at the boundary
and a lot of times, we forget about those people
inside our walls already that are doing things against us.
And so, when you think about this
from a security perspective,
you need to think not just of the bad guy
who's outside your walls trying to break in,
but you also need to think about those people
who you trust, those employees you have
because they may not be working
with your best interests at heart.
And so you have to keep an eye on that
and there's lots of ways to do that.
One of the ways we talked about before was DLP.
Data Loss Protection, right?
You install Data Loss Protection and it will keep track
of all the files that are being copied and downloaded
so you can go back and figure out,
was that person really stealing from you
or were they just doing their job?
That's the idea with an insider threat
and it's something you need to be aware of
as a good security professional.