INSIDER THREAT KILL CHAIN презентация

Crimes in the United States

admin access to the company’s 4K servers
Wrote logic bomb to disable logins and wipe logs on Jan 1, 2009
Another engineer found the code before it could execute
Sentenced to 41 months in prison
Before being caught had gone on to work for Bank of America, Amtrak and GE as Sr. Systems Administrator

Rajendrasinh Babubhai Makwana

ADMINS GONE WILD

and enforce policies and controls
Periodic security awareness training for all employees
Monitor and respond to suspicious or disruptive behavior
Anticipate and manage negative workplace issues
Track and secure physical environment
Establish clear lines of communication and procedures between HR, Legal and IT

AWARENESS & TRAINING

of duties and least privilege
Extra caution with system administrators and technical or privileged users
Implement system change controls
Deactivate computer access following termination

Log, monitor, and audit employee network activities

POLICY & TECHNOLOGY

alerts
Change management

BARE MINIMUM TO START

before selecting log management tool
Establish log management policies and procedure: Ensure this includes log retention policies (work with legal counsel for requirements), what is collected and who manages logging systems
False positives: Security devices make a lot of noise, tune system to reduce false positives and focus on events that matter
Establish a baseline: What is normal behavior? Set baselines to distinguish anomalies from true threats
Accessing information: Multiple departments need to access data to determine what information will be collected and who has permission to view…not just SOC

CHALLENGES WITH LOG INTELLIGENCE & SIEM

see if he connects to to servers outside the network
Set rules to watch and alert on connections from outgoing ports after hours: 22 (SSH), 23 (Telnet), 3389 (Terminal Services/RDP)

see if he connects to to servers outside the network
Set rules to watch and alert on connections from outgoing ports after hours: 22 (SSH), 23 (Telnet), 3389 (Terminal Services/RDP)

2014-04-07T12:17:32
maliciousinsider
10.0.0.1
insider_system
TCP
{22,23,3389}
17:00:00
08:00:00

terminated system admin in use
Account was logging into network at 4AM on a Wednesday
Also discovered logging disabled on key firewall

MALICIOUS INSIDERS UNVEILED

and Tripwire Enterprise at large tire retailer
Discovered backdoor setup by terminated employee that was actively being accessed

MALICIOUS INSIDERS UNVEILED

an insider incident response plan (inter-departmental)

Carrier

http://www.wired.com/2014/05/navy-sysadmin-hacking/