Save 50% on book bundles
Immediately download your ebook while waiting for your print delivery. No promo code is needed.
Back to School Savings: Save up to 30% on print books and eBooks. No promo code needed.
Back to School Savings: Save up to 30%
Enemy at the Water Cooler
True Stories of Insider Threats and Enterprise Security Management Countermeasures
1st Edition - October 30, 2006
Author: Brian T Contos
eBook ISBN:
9 7 8 - 0 - 0 8 - 0 4 7 7 6 0 - 2
The book covers a decade of work with some of the largest commercial and government agencies around the world in addressing cyber security related to malicious insiders (trusted… Read more
Purchase Options
The book covers a decade of work with some of the largest commercial and government agencies around the world in addressing cyber security related to malicious insiders (trusted employees, contractors, and partners). It explores organized crime, terrorist threats, and hackers. It addresses the steps organizations must take to address insider threats at a people, process, and technology level. Today’s headlines are littered with news of identity thieves, organized cyber criminals, corporate espionage, nation-state threats, and terrorists. They represent the next wave of security threats but still possess nowhere near the devastating potential of the most insidious threat: the insider. This is not the bored 16-year-old hacker. We are talking about insiders like you and me, trusted employees with access to information - consultants, contractors, partners, visitors, vendors, and cleaning crews. Anyone in an organization’s building or networks that possesses some level of trust.
* Full coverage of this hot topic for virtually every global 5000 organization, government agency, and individual interested in security.
* Brian Contos is the Chief Security Officer for one of the most well known, profitable and respected security software companies in the U.S.—ArcSight.
* Brian Contos is the Chief Security Officer for one of the most well known, profitable and respected security software companies in the U.S.—ArcSight.
The audience for this book is diverse because those impacted by insiders are also diverse. For those not familiar with insider threats, it will provide a strong foundation. For the expert, it will supply useful anecdotes and outline countermeasures. While the book itself isn’t technical by design, certain subjects do require technical elaboration. Portions of it are designed to address strategic business-level objectives. But since insider threat requires responses from IT operations and security analysts as well as from managers and executives, I’ve written for an inclusive audience. Anyone interested in insider threat— regardless of business perspective—will find useful information within these pages.
Part I: Background on Cyber Crime, Insider Threats, and ESM
Chapter One: Cyber Crime and Cyber Criminals
• About this Chapter
• Computer Dependence and Internet Growth
• The Shrinking Vulnerability Threat Window
• Motivations for Cyber Criminal Activity
o Black Markets
• Hacker
• Script Kiddies
• Solitary Cyber Criminals and Exploit Writers for Hire
• Organized Crime
• Identity Thieves (Impersonation Fraudsters)
• Competitors
• Activist Groups, Nation-State Threats, and Terrorists
• Activists
• Nation-State Threats
o China
o France
o Russia
o United Kingdom
o United States
• Terrorists
• Insiders
• Tools of the Trade
o Application-Layer Exploits
o Botnets
o Buffer Overflows
o Code Packing
o Denial-of-service (DoS) Attacks
o More Aggressive and Sophisticated Malware
o Non-wired Attacks and Mobile Devices
o Password-cracking
o Phishing
o Reconnaissance and Googledorks
o Rootkits and Keyloggers
o Social Engineering Attacks
o Voice over IP (VoIP) Attacks
o Zero-Day Exploits
• Summary Points
Chapter Two: Insider Threats
• Understanding Who the Insider Is
• Psychology of Insider Identification
• Insider Threat Examples from the Media
• Insider Threats from a Human Perspective
o A Word on Policies
• Insider Threats from a Business Perspective
o Risk
• Insider Threats from a Technical Perspective
o Need-to-know
o Least Privileges
o Separation of Duties
o Strong Authentication
o Access Controls
o Incident Detection and Incident Management
• Summary Points
Chapter Three: Enterprise Security Management (ESM)
• ESM in a Nutshell
• Key ESM Feature Requirements
o Event Collection
o Normalization
o Categorization
o Asset Information
o Vulnerability Information
o Zoning and Global Positioning System Data
o Active Lists
o Actors
o Data Content
o Correlation
o Prioritization
o Event and Response Time Reduction
o Anomaly Detection
o Pattern Discovery
o Alerting
o Case Management
o Real-Time Analysis and Forensic Investigation
o Visualization
o High-level Dashboards
o Detailed Visualization
o Reporting
o Remediation
• Return On Investment (ROI) and Return On Security Investment (ROSI)
• Alternatives to ESM
o Do Nothing
o Custom In-house Solutions
o Outsourcing and Co-sourcing
? Co-sourcing examples:
• Summary Points
Part II: Real Life Case Studies
Chapter Four: Imbalanced Security—A Singaporean Data Center
Chapter Five: Correlating Physical and Logical Security Events—A U.S. Government Organization
Chapter Six: Insider with a Conscience—An Austrian Retailer
Chapter Seven: Collaborative Threat—A Telecommunications Company in the U.S.
Chapter Eight: Outbreak from Within—A Financial Organization in the U.K.
Chapter Nine: Mixing Revenge and Passwords—A Utility Company in Brazil
Chapter Ten: Rapid Remediation—A University in the United States
Chapter Eleven: Suspicious Activity—A Consulting Company in Spain
Chapter Twelve: Insiders Abridged
• Malicious use of Medical Records
• Hosting Pirated Software
• Pod-Slurping
• Auctioning State Property
• Writing Code for another Company
• Outsourced Insiders
• Smuggling Gold in Rattus Norvegicus
Part III: The Extensibility of ESM
Chapter Thirteen: Establishing Chain-of-Custody Best Practices with ESM
• Disclaimer
• Monitoring and disclosure
• Provider Protection Exception
• Consent Exception
• Computer Trespasser Exception
• Court Order Exception
• Best Practices
• Canadian Best Evidence Rule
• Summary Points
Chapter Fourteen: Addressing Both Insider Threats and Sarbanes-Oxley with ESM
• A Primer on Sarbanes-Oxley
• Section 302: Corporate Responsibility for Financial Reports
• Section 404: Management Assessment of Internal Controls
• Separation of Duties
• Monitoring Interaction with Financial Processes
• Detecting Changes in Controls over Financial Systems
• Section 409: Real-time Issuer Disclosures
• Summary Points
Chapter Fifteen: Incident Management with ESM
• Incident Management Basics
• Improved Risk Management
• Improved Compliance
• Reduced Costs
• Current Challenges
o Process
o Organization
o Technology
• Building an Incident Management Program
o Defining Risk
• Five Steps to Risk Definition for Incident Management
o Process
o Training
o Stakeholder Involvement
o Remediation
o Documentation
• Reporting and Metrics
• Summary Points
Chapter Sixteen: Insider Threat Questions and Answers
• Introduction
• Insider Threat Recap
• Question One - Employees
o The Hiring Process
o Reviews
o Awareness
o NIST 800-50
o Policies
o Standards
o Security Memorandum Example
• Question Two - Prevention
• Question Three – Asset Inventories
• Question Four – Log Collection
o Security Application Logs
o Operating System Log
o Web Server Logs
o NIST 800-92
• Question Five – Log Analysis
• Question Six - Specialized Insider Content
• Question Seven – Physical and Logical Security Convergence
• Question Eight – IT Governance
o NIST 800-53
o Network Account Deletion maps to NIST 800-53 section AC-2
o Vulnerability Scanning maps to NIST 800-53 section RA-5
o Asset Creation maps to NIST 800-53 section CM-4
o Attacks and Suspicious Activity from Public Facing Assets maps to NIST 800-53 section SC-14
o Traffic from Internal to External Assets maps to NIST 800-53 section SC-7
• Question Nine - Incident Response
• Question 10 – Must Haves
Appendix A—Examples of Cyber Crime Prosecutions
Chapter One: Cyber Crime and Cyber Criminals
• About this Chapter
• Computer Dependence and Internet Growth
• The Shrinking Vulnerability Threat Window
• Motivations for Cyber Criminal Activity
o Black Markets
• Hacker
• Script Kiddies
• Solitary Cyber Criminals and Exploit Writers for Hire
• Organized Crime
• Identity Thieves (Impersonation Fraudsters)
• Competitors
• Activist Groups, Nation-State Threats, and Terrorists
• Activists
• Nation-State Threats
o China
o France
o Russia
o United Kingdom
o United States
• Terrorists
• Insiders
• Tools of the Trade
o Application-Layer Exploits
o Botnets
o Buffer Overflows
o Code Packing
o Denial-of-service (DoS) Attacks
o More Aggressive and Sophisticated Malware
o Non-wired Attacks and Mobile Devices
o Password-cracking
o Phishing
o Reconnaissance and Googledorks
o Rootkits and Keyloggers
o Social Engineering Attacks
o Voice over IP (VoIP) Attacks
o Zero-Day Exploits
• Summary Points
Chapter Two: Insider Threats
• Understanding Who the Insider Is
• Psychology of Insider Identification
• Insider Threat Examples from the Media
• Insider Threats from a Human Perspective
o A Word on Policies
• Insider Threats from a Business Perspective
o Risk
• Insider Threats from a Technical Perspective
o Need-to-know
o Least Privileges
o Separation of Duties
o Strong Authentication
o Access Controls
o Incident Detection and Incident Management
• Summary Points
Chapter Three: Enterprise Security Management (ESM)
• ESM in a Nutshell
• Key ESM Feature Requirements
o Event Collection
o Normalization
o Categorization
o Asset Information
o Vulnerability Information
o Zoning and Global Positioning System Data
o Active Lists
o Actors
o Data Content
o Correlation
o Prioritization
o Event and Response Time Reduction
o Anomaly Detection
o Pattern Discovery
o Alerting
o Case Management
o Real-Time Analysis and Forensic Investigation
o Visualization
o High-level Dashboards
o Detailed Visualization
o Reporting
o Remediation
• Return On Investment (ROI) and Return On Security Investment (ROSI)
• Alternatives to ESM
o Do Nothing
o Custom In-house Solutions
o Outsourcing and Co-sourcing
? Co-sourcing examples:
• Summary Points
Part II: Real Life Case Studies
Chapter Four: Imbalanced Security—A Singaporean Data Center
Chapter Five: Correlating Physical and Logical Security Events—A U.S. Government Organization
Chapter Six: Insider with a Conscience—An Austrian Retailer
Chapter Seven: Collaborative Threat—A Telecommunications Company in the U.S.
Chapter Eight: Outbreak from Within—A Financial Organization in the U.K.
Chapter Nine: Mixing Revenge and Passwords—A Utility Company in Brazil
Chapter Ten: Rapid Remediation—A University in the United States
Chapter Eleven: Suspicious Activity—A Consulting Company in Spain
Chapter Twelve: Insiders Abridged
• Malicious use of Medical Records
• Hosting Pirated Software
• Pod-Slurping
• Auctioning State Property
• Writing Code for another Company
• Outsourced Insiders
• Smuggling Gold in Rattus Norvegicus
Part III: The Extensibility of ESM
Chapter Thirteen: Establishing Chain-of-Custody Best Practices with ESM
• Disclaimer
• Monitoring and disclosure
• Provider Protection Exception
• Consent Exception
• Computer Trespasser Exception
• Court Order Exception
• Best Practices
• Canadian Best Evidence Rule
• Summary Points
Chapter Fourteen: Addressing Both Insider Threats and Sarbanes-Oxley with ESM
• A Primer on Sarbanes-Oxley
• Section 302: Corporate Responsibility for Financial Reports
• Section 404: Management Assessment of Internal Controls
• Separation of Duties
• Monitoring Interaction with Financial Processes
• Detecting Changes in Controls over Financial Systems
• Section 409: Real-time Issuer Disclosures
• Summary Points
Chapter Fifteen: Incident Management with ESM
• Incident Management Basics
• Improved Risk Management
• Improved Compliance
• Reduced Costs
• Current Challenges
o Process
o Organization
o Technology
• Building an Incident Management Program
o Defining Risk
• Five Steps to Risk Definition for Incident Management
o Process
o Training
o Stakeholder Involvement
o Remediation
o Documentation
• Reporting and Metrics
• Summary Points
Chapter Sixteen: Insider Threat Questions and Answers
• Introduction
• Insider Threat Recap
• Question One - Employees
o The Hiring Process
o Reviews
o Awareness
o NIST 800-50
o Policies
o Standards
o Security Memorandum Example
• Question Two - Prevention
• Question Three – Asset Inventories
• Question Four – Log Collection
o Security Application Logs
o Operating System Log
o Web Server Logs
o NIST 800-92
• Question Five – Log Analysis
• Question Six - Specialized Insider Content
• Question Seven – Physical and Logical Security Convergence
• Question Eight – IT Governance
o NIST 800-53
o Network Account Deletion maps to NIST 800-53 section AC-2
o Vulnerability Scanning maps to NIST 800-53 section RA-5
o Asset Creation maps to NIST 800-53 section CM-4
o Attacks and Suspicious Activity from Public Facing Assets maps to NIST 800-53 section SC-14
o Traffic from Internal to External Assets maps to NIST 800-53 section SC-7
• Question Nine - Incident Response
• Question 10 – Must Haves
Appendix A—Examples of Cyber Crime Prosecutions
- No. of pages: 304
- Language: English
- Published: October 30, 2006
- Imprint: Syngress
- eBook ISBN: 9780080477602
BC
Brian T Contos
Brian T. Contos, CISSP, Chief Security Officer, ArcSight Inc. has over a decade of real-world security engineering and management expertise developed in some of the most sensitive and mission-critical environments in the world. As ArcSight's CSO he advises government organizations and Global 1,000s on security strategy related to Enterprise Security Management (ESM) solutions while being an evangelist for the security space. He has delivered security-related speeches, white papers, webcasts, podcasts and most recently published a book on insider threats titled – Enemy at the Water Cooler. He frequently appears in media outlets including: Forbes, The London Times, Computerworld, SC Magazine, Tech News World, Financial Sector Technology and the Sarbanes-Oxley Compliance Journal. Mr. Contos has held management and engineering positions at Riptech, Lucent Bell Labs, Compaq Computers and the Defense Information Systems Agency (DISA). He has worked throughout North America, South America, Western Europe, and Asia and holds a B.S. from the University of Arizona in addition to a number of industry and vendor certifications.
Affiliations and expertise
CISSP, Chief Security Officer, ArcSight Inc.