Insider Threat

The DNI has modestly more power than the old Directors of Central Intelligence (DCIs), but not enough to give the ODNI/AIS real clout. “Herding cats” remains a decent description of the ODNI’s basic role. The DNI has several duties and responsibilities, but for the subject of improving intelligence information sharing the focus will be directed towards: Improving Analytics, Improving Information Security, Improving Foreign Liaison Relationships, and the end state of Improving Information Sharing.

A single insider could steal secrets from critical infrastructures or leave them vulnerable to a future hack, which could have residual effects for years, such as the company Target and its reputation after the company was hacked. Further, insiders like Edward Snowden have set back American national security for years to come, by exposing secret security practices to the world. The government proposed in S.3414, to conduct background checks, focus on employee training, and assure that the necessary management are enlisted. These steps might stop the insider threat, but are measures to help reduce the threat. The benefits would also lead to better productivity and ensure the right employees are emplace to meet the industry standards and comply with policy. A new proposed bill should incorporate this feature within the government and be an option within privately owned critical infrastructures with incentives if guidance is

8. Which domain requires annual security awareness training and employee background checks for sensitive positions to help mitigate risk from employee sabotage? The user domain. Employees should at least be aware of social engineered attacks and potential risk that they, the employee could do.

The first of these threats is Social Engineering. Social Engineering according to Social-Engineer.org (2013), is “the act of influencing a person to accomplish goals that may or may not be in the ‘target’s’ best interest. This may include obtaining information, gaining access, or getting the target to take certain action.” The employees themselves are the area of the system affected by this threat. Social Engineering exploits their naivety. General lack of experience in recognizing this type of attack is a major reason for its success. Education on what Social Engineering is and how to recognize attacks coupled with company policies written, put into place, and enforced to prevent individuals from divulging or even having access to certain information no matter the scenario is the recommended course of action.

One of the biggest challenges for the Intelligence Community (IC) is the balance between gathering actionable intelligence using a variety of intelligence gathering methods with violating the civil liberties of United States citizens. As we discussed last week oversight of the IC by our congressional leaders is at the forefront of ensuring civil liberties and funding for programs are not being abused. The American citizens depend on the congress and the IC to ensure civil liberties are adhered to during all intelligence gathering. The problem is security of information and at times having to reach the tipping point of civil liberties to ensure the public stay safe can cause concern.

With a newer organization, like the Department of Homeland Intelligence, a new hierarchical structure could be assembled to enable cooperation efforts between various IC agencies. Today, 15 of the 16 IC agencies lie under five executive branches aiding in the segregation of the agencies from one another (Zegart 2007). Bringing the intelligence agencies closer together may assist in easier dissemination of information. Indeed, intelligence agencies have fought to hold on to valued information or have been in competition with other agencies. Bringing the IC under one command, with an established chain of command, would help reduce competition efforts amongst agencies thereby boosting cooperation

In 2004, through the Intelligence Reform and Terrorist Prevention Act (IRTPA), Congress outlined specific duties and authorities for the DNI. These duties include: providing timely intelligence to the President and other senior level decision makers, developing and executing the National Intelligence Program Budget, and numerous other duties and authorities, but perhaps the most relevant to this discussion is the intelligence information sharing section. “The Director of National Intelligence shall have principal authority to ensure maximum availability of and access to intelligence information within the intelligence community consistent with national security requirements” (IRTPA, 2004). If we break this statue further, we will see that Congress identifies even more specific tasks which will enable better communication flow and collaboration between agencies within the IC; however, some of those will take years to institute and will requires organizational and cultural changes.

Headquarters of the National Security Agency (NSA), employees a multitude of employees consisting of computer scientists, analysists, linguists, voice interceptors and mathematicians. (Factory, T.S. Nova, 2009) The scope of what happens behind closed doors at the National Security Agency is mind boggling. The average citizen could not even begin to apprehend the complex work these professional complete in a normal work week. The employees at the National Security Agency monitor terrorist by intercepting and interpreting phone calls, e-mails, webmail, monitors social media and website sites. Nova’s program “The Spy Factory” explores how safe is our county when it comes to terrorism. Nova brings up some interesting facts that are chilling and make you think, are we really safe in America?

Countermeasures: Detect insider threats. Insiders have caused grave, long-term damage to national security. History has demonstrated the intent of foreign intelligence services and entities to penetrate the Intelligence Community and extract information using a trusted insider – recruited or volunteer. The Intelligence Community must be positioned to detect, respond to, and deter this threat. Currently, the Intelligence Community is creating a unified approach to combating insider threats. The Insider Threat Advisory Group (ITAG) leverages information assurance, security, and counterintelligence to detect, deter, and mitigate the insider threat. The ITAG has identified fundamental insider threat elements, will define their "best practices,"

Implement a security training program for IT employees and any employee manipulating customer sensitive data

Before my team assessed the efficacy of an insider threat program, we lacked several essential aspects crucial for mitigating, detecting, and preventing insider threats. Our former insider threat program lacked a lot of essential things and thus, made Goliath National Bank vulnerable to insider threats that could have potentially harmed its assets and intellectual property like trade secrets, strategic plans, and other confidential information. In order to protect the organization, Avatar should have placed more emphasis upon behavioral indicators instead of directing most of their effort and attention on technical indicators. If Goliath National Bank had noticed the red flags and realized that the insider threat was a disgruntled employee, he wouldn’t have been able to create and inflict so much damage through espionage. Thus, it is crucial for organizations to monitor their employee’s network on their personal or work device. In addition, our insider threat program lacked two of the five NIST framework core functions (i.e. identify, protect, detect, respond, and recover), which are important for risk management. Our insider threat program failed to address the respond and recover function. Since all the functions are interdependent upon one another and are necessary for proper, prompt, and efficient risk management, without any one of them, a lot of damage can result. The response function is essential because it has to do with the actions needed to be taken after a cyber security threat is detected. An organization has to know prior what specific action they want to take, whether it plans to gather data for law enforcement or take legal action to prevent the situation from escalating. The decision is crucial because it impacts the direction the organization takes. The recover function is crucial because it serves to decrease the impact and restore

Security Officers must obtain a consensus for which mitigating controls are key, which can be a trying negotiation between the CISO, Chief Technology Officer, Cyber Threat Intelligence (CTI), Infrastructure Engineering, Audit and Assurance teams, and the Investment and Audit committees. How do you harness your entire organization to focus on a common agreed-upon list of key security controls?

Insider threat can be defined as a malicious threat that comes from someone inside the organization. “An insider threat does not have to be a present employee or stakeholder, but can also be a former employee, board member, or anyone who at one time had access to proprietary or confidential information from within an organization or entity. Contractors, business associates, and other individuals or third-party entities who have knowledge of an organization’s security practices, confidential information, or access to protected networks or databases also fall under the umbrella of insider threat” (Lord 1). Given the scope of the potential perpetrators, It is easy to see why this type of threat could be hard to protect against.

13. Which members of an organization are involved in the security system development life cycle? Who leads the process?

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets.  A framework is the outline from which a more detailed blueprint evolves.  The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies.  The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years.  The blueprint is used to plan the tasks to be accomplished and the order in which