But the real issue here is not that the systems are vulnerable; the bigger issue is that despite the fact that the CIA, NSA and other government organizations have some of the most restricted and compartmented networks in the world, people are still managing to extract the data from the secure environments and distribute them widely. If this is happening on the most restricted networks on the planet, how can regular companies, whose C-suites are not nearly as focused on protecting their data as the CIA is, be safe from leaks?

I imagine that when most people saw the movie Snowden, they thought that it was an accurate description of how he was managing to get data out of the NSA.

Guess what? You’re wrong.

Movies do a great job of romanticizing real events. The truth is, it is highly unlikely that any whistleblower from classified government agencies are extracting data from compartmented networks through the use of removable storage devices. Unless you are a privileged user, it is highly unlikely that you would be able to remove any data onto a USB or SD card. So how is it likely happening? Good old fashioned human couriers, who print the data, throw it in their backpack, and walk out of the building. Individuals like Edward Snowden have solidified how easy it is to walk out of a facility with extremely sensitive data and at the end of the day, still be viewed as so-called “hero”. Crazy right? If he can do this, imagine what can be done in a less secure environment. While systems and data are often well protected from outside attacks, insider threats are much harder to identify. Below are a few ways to protect yourself against insider threats:

Purchase a good UEBA Solution That Fits Your Needs:

Avivah Laten from Gartner recently said the UEBA is a dying market. This may be true from a stand-alone product perspective, however the behavioral analysis provided by UEBA products is needed now more than ever. Products such as Fortscale can help you identify when a user is accessing new servers, areas of the network, and even printing large amounts of information. This could have been extremely useful to the NSA in protecting against Edward Snowden (that Rubiks cube story is pure nonsense!). Other systems, like RedOwl provide data lexicon capabilities which allow companies to monitor the language of emails and other data sources in order to thwart suspicious behavior BEFORE a leak occurs. This can be extremely useful in use cases of insider trading or Intellectual Property protection.

Implement a Strong Data Loss Prevention (DLP) Solution

There are many DLP solutions currently available in the market. It’s important to implement one that fits your internal organization’s needs. Many solutions offer features such as data discovery, which moves sensitive data out of unprotected storage. Solutions are also broken down into monitoring vs. prevention, and manual vs. automated remediation, providing security teams with differing level of resources various options in managing potential data leaks. Many endpoint protection systems also have DLP components which can be easily implemented without the additional purchase of another product.

Protect Your Data in Storage

Implementing data-centric security is also an important factor of thwarting insider threats. This can be accomplished by ensuring sensitive data is encrypted, and proper access controls are in place to protect the data from both privileged and unauthorized users. More importantly, security professionals need to be aware of where data is stored in order to properly protect it. This means implementing protection on cloud architectures, backups and disaster recovery locations as well. Products such as VeraCrypt (a TrueCrypt replacement) can help with adding another layer of security in the ever-growing environment of cloud storage.

In the Information Era, there is nothing scarier than the notion of an insider threat. This is why it is important now more than ever to ensure your data is protected not only against malicious outsiders, but also against that one employee who may just have something to gain from leaking your data. Is your organization prepared for the insider threat?

Table Top Exercises and Others

Much like a fire drill, many businesses utilize exercises or security scenarios to prepare and protect against potential incidents. These exercises range from interactive settings responding to penetration test attempts to test the response of the IT and Security teams, to simple table top exercises where teams within the organization work together to walk through potential scenarios associated with security breaches. Exercises can also be controlled, where all team members are aware that it is an exercise, while other exercises are unknown, in order to test the team’s true response to a potential incident. While the executive team does not necessarily need to be involved in the technical reactions to an incident, they should be responsible for high-level management and response. This can be accomplished through simple Table Top Exercises, where the C-Suite is provided with scenarios which require their action and attention.

Exercising Success

Getting the boardroom involved is the first step in their preparation for handling a cyber-attack; the next is a successful plan for the executive team. Below are some best practices to ensure a successful exercise for the C-Suite:

Identify Critical Information Systems which would cause the most damage if breached. Since we already know it’s a matter of “when” and not “if”, it is important to identify your most critical assets based on your business structure and offerings. It is essential that the C-Suite understand the areas which require the greatest amount of urgency if breached in order to exercise the appropriate response.

Maintain broad, realistic scenarios. Since executives will not be directly mitigating the incident, it is best to keep scenarios broad and as realistic as possible. This will allow you to run through various potential risk types in a shorter period since many incidents will elicit the same response from the executive team. Some examples may include system degradation due to natural disasters, insider threats, physical breaches, and mass data leakage due to an Advanced Persistent Threat. The broader scenarios will also allow executives to approach the issues through analytic thinking as opposed to elicited responses.

Prepare the executive team before the exercise. Given the statistic of CEOs who do not believe they are prepared to deal with a cyber-attack, most executive teams will likely not have the proper knowledge to respond to the exercises. Therefore, preparation is crucial. Educating executives on appropriate actions to take, questions to ask, and Key Performance Indicators to asses for different scenarios prior to the exercise will provide them with the opportunity to react more appropriately during the exercise, while still thinking critically. It will also help to make the exercise less daunting to the C-Suite.

Be ready to address the knowledge gaps. Once the exercise is over, there should be a clear representation of the abilities of your executive team to respond to a security incident; however, identifying the disparities is not enough. Results of the executive team’s ability to properly respond to the exercise should be reported and mitigated through additional training and revalidation. This training and education can be conducted by the internal security team, if they are equipped to do it, or by a training service provider.

Talk Is Cheap

The initiative to discuss the importance of cyber security in the boardroom is a great start to getting executives involved and educated on their roles and responsibilities; unfortunately, it’s still not enough. As information security professionals, we must continue to advocate and support active participation and involvement in security exercises by all C-Suite members to ensure the safety and security of our businesses.

How do you get your executives involved?