A Framework to Effectively Develop Insider Threat Controls
summary
CERT’s insiders team presents an empirically based framework for identifying insider threats to critical assets and for developing, implementing, and measuring both technical and nontechnical controls and detection capabilities. The framework covers specific technical and nontechnical data sources for anomaly detection and shows how to implement management, operational, and technical controls, illustrated with real insider harm incidents.
AI-written summary · about
chapters (21)
- 0:00RSAConference 2018
- 6:22How Pervasive is the issue?
- 7:31What Can You Do?
- 9:41Presentation Objectives
- 10:48A Process for Insider Threat Control Implementation and Operation
- 12:09Insider Threats to Critical Assets
- 15:02Identifying Insider Threats Within Your Organization - 1
- 20:21Different Control Functions
- 22:06NIST SP 800-53 Revision 4 Insider Threat Controls - 1
- 23:14Tools for Detecting, Preventing, and Responding to Insider Incidents
- 24:13Policies and Procedures for Insider Threat Mitigation
- 25:28Selecting Security Controls
- 26:29Example - IT Systems Sabotage Model
- 30:28Mapping Model Components to Observables
- 32:06Mapping Observables to Controls - 1
- 34:27Measures of Effectiveness
- 38:32Insider Threat Control Testing Techniques
- 40:55Insider Threats are Dynamic
- 42:55Summary
- 43:51Applying What You Have Learned Today
- 44:46Presenter Contact Information
related talks
15mPredictive Techniques to Catch Insider Threats Before they Become Criminals
48mStop Chasing Insider Threats, Start Managing Insider Risk
20mIntriguing Insider Threat Cases - Make Sure This Doesn't Happen to You!
55mDeveloping a Conceptual Model for Insider Threat
46mInside Payback: Using Metrics to Demonstrate Insider Risk Program Value
28mCyber Threat Intelligence Analysts and You
40mA Data Protection Problem: Insider Risk
48mData-Driven Cyber Indicators of Malicious Insider Threat