Module 7: Handling Insider Threats Flashcards
What makes an insider threat so dangerous
They misuse their authorized privileges on resources that directly affect the CIA of the information system
What are some examples of potential impacts that insider threats have on an organization
- Bad reputation
- Stealing PII or other private information
- Website defacement
- Posting confidential information on any public website
According to EC Council what is the structure of how an insider threat occurs
- Understand business process
- Gain credentials and trust
- Install logic bombs and rootkits
- Activate those logic bombs and rootkits
- Damage the company for financial gain or revenge
What is the the greatest risk according to the insider risk matrix
If the insiders’ technical literacy and process knowledge is high
See page 415 for the graph of the matrix
What are some different ways to detect an insider threat
- Checking the logs (event, email, database, app, file access, and remote access)
- Alerts from various network security devices and applications
- Implementing control measures
- Identifying the behavior of users
What are 3 different techniques to detect an insider threat
- Correlation
- Detecting Anomaly (anything out of the norm?)
- Discovering Pattern
TRUE or FALSE: Placing suspected users in a quarantined network is a good way to response to an insider threat
TRUE
This is done so that the damage is minimized
TRUE or FALSE: The user doesn’t need to have their accounts blocked because it might tip them off they IT security is looking at them
FALSE
It is a good idea to block malicious users from their accounts as soon as possible before they do even more damage
TRUE or FALSE: The organization should not share or provide the details of the insider’s incident response plan with all employees
TRUE
The organization should share the response plan with those who have the capability to understand and perform the plan
Why is an incident response plan necessary for an insider threat situation
It helps the organization to minimize or limit the damage cause due to malicious insiders
While it may not seem important to IT Security, what are some ways HR can help to mitigate the threat of insider threat
- Background checks
- Manage negative workplace issues
- Prepare an information security policy document and have employees sign the doc
- Respond to suspicious behavior of employees
Network security is an important aspect to help mitigate insider threats by
- Configured firewalls
- Strict passwords
- DLP
- Prevent file sharing
The good news is that we have this implemented in our environment…Woot GO Team
How are users able to get access privileges
It is based on their routine performance of their job
Who should vet a user’s access requests
Their supervisor
Who should employees ask before accessing sensitive systems
Data owners
TRUE or FALSE: When an employee is terminated from his job the employers should disable all their access rights
TRUE
What should be enforced that is used to limit the misuse of resources
Separation-of-duties
TRUE or FALSE: Employees shouldn’t be made aware of an organization’s security policies and controls
FALSE
What should be disabled to ensure accountability
Default administrative accounts
What technique is implemented to view all the actions performed by admins
Non-repudiation
TRUE or FALSE: IT security needs to monitor the activities of system admins who have permissions to access sensitive info
TRUE
What kind of methods need to be enforced to prevent admins from accessing backup tapes
Encryption
How can a business continue operations after the incident
Implement secure backup and recovery processes
What part of the CIA needs to be checked when backups are done
Integrity and Availability
TRUE or FALSE: The BCP is the document that shows who accessed and handling of the backup media
FALSE
Chain-of-Custody
Insider threats can be detected by observing concerning behaviors exhibited by insiders, such as conflicts with supervisors and coworkers, decline in performance, tardiness, or unexplained absenteeism. What technique helps in detecting insider threats
Correlating known patterns of suspicious and malicious behavior
When an employee is terminated from his/her job, what should be the next immediate step taken by an organization
All access rights of the employee should be disabled
