Ghosts in the Machine… Is There a Security Patch for People?
summary
Claims a practical, three‑pronged program: know your people, know your data, know your threats, backed by FBI/industry experience and MITRE mapping of 40 cases to 20 high‑frequency subtechniques. Key metrics: 82% of security incidents tie to insiders, ~1/3 intentional vs 2/3 negligent, $8–15M average loss. Concrete controls recommended: DLP, UEBA, ZTA, role‑based logging, pre‑hire vetting and continuous checks, dark‑web recruitment monitoring, and focus on the common exfil vectors Exfil to cloud storage and USB rather than boiling the ocean.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 5:42Insider threat statistics
- 8:31Risk, capability and motive
- 15:57Employee risk profiles
- 20:56Insider threat lifecycle
- 25:09MITRE attack framework
- 27:57Anomaly detection methods
- 31:05External threat intelligence
- 33:34Pre-employment vetting
- 36:04Incident response planning
- 38:10Holistic insider threat approach
- 41:44Q&A and contact info
related talks
38mDo You Feel Secure?
40mTotal Security: Investigative Perspectives from Public to Private Sector
26mThe Risky Business of Risk Illiteracy (Sean Juroviesky)
29mGet the Freaking Basics Right!
41mHuman Vulnerability Management and Assessment in the Age of Zero Trust
40mEnemy Inside the Gates: Securing the New Battleground
21mhow to reconcile high-performance hosting and innovation projects with IT security
30mSecurity Starts With You: Social Engineering