- Eric Andresen, IT Security Manager, SSAB Americas
- Jeff Tandy, Senior IT Security Specialist, General Dynamics Land Systems
- Bob Turner, CISO, University of Wisconsin-Madison
- 1 anonymous contributor, Network End Security Manager, Municipal Government
- The hard digital wall has crumbled. Organizations have focused on defending against external threats but equally need to protect against insider threats.
- Poor visibility into your insider threats cannot continue as they can cause significant damage to your organization’s business, workflow, revenue, and reputation.
- You can’t just throw tools at a human problem. While organizations should monitor critical assets and groups with privileged access to defend against malicious behavior, good management and supervision can help detect and prevent attacks from happening in the first place.
- Insider threats will persist without appropriate action and culture change. Training and consistent communication of best practices will mitigate vulnerabilities to accidental or negligent attacks.
- Without a formal policy and procedure, monitoring for insider threats can only be ad hoc at best, or at worst miss essential information. Target your monitoring of critical assets and users with privileged access to cover all kinds of insider threats.
Impact and Result
- Effective and efficient management of insider threats begins with a threat and risk assessment to establish which assets and which employees are associated with sensitive or critical data, as well as to determine the current maturity of your security posture.
- This blueprint will walk through the steps of understanding what constitutes insider threat, your current security maturity, how to implement an insider threat program, and best practices for monitoring your organization.
This guided implementation is a four call advisory process.
Guided Implementation #1 - Understand what insider threats are and where they come from
Call #1 - Establish a TRA.
Call #2 - Explore the elements of a mature insider threat program.
Guided Implementation #2 - Implement an insider threat program