Catching Insiders

I have discussed the insider threat a number of times and recently came across this article on the Dark Reading Website Five Habits Of Companies That Catch Insiders - Dark Reading which discusses the controls or habits that will aid in catching insiders.

The report Insider Threat Study: Illicit Cyber Activity Involving Fraud in the U.S. Financial Services Sector this article was based on made a number of recommendations which I have listed here


Behavioral and/or Business Process

• Clearly document and consistently enforce policies and controls.
• Institute periodic security awareness training for all employees.

Monitoring and Technical

• Include unexplained financial gain in any periodic reinvestigations of employees.
• Log, monitor, and audit employee online actions.
• Pay special attention to those in special positions of trust and authority with relatively easy ability to perpetrate high value crimes (e.g., accountants and managers).
• Restrict access to PII.
• Develop an insider incident response plan to control the damage from malicious insider activity, assist in the investigative process, and incorporate lessons learned to continually improve the plan

I do recommend reading the article and the report to gain a better understanding of the controls that reduce the insider threat.