Posted by Martijn Grooten on Aug 30, 2017
"How to catch a Snowden" was the slogan branded across an exhibition booth at the recent Infosecurity Europe event by an exhibitor apparently offering a solution to insider threats. Whether you think it appropriate to use the NSA whistle-blower as an example, insider threats are real, and the concern organizations have – both about employees whose accounts get compromised and about those whose interests don't align with the organization's – are genuine.
The subject is discussed at great length in the paper "From insider threat to insider asset: a practical guide", which will be presented at VB2017 in Madrid by Forcepoint's Kristin Leary and Richard Ford. The latter has a long history in security (including a stint working as Editor of Virus Bulletin), but it is Kristin's role as the company's Chief Human Resources Officer that makes this paper particularly interesting.
In their paper, Kristin and Richard first discuss various technical approaches to creating an insider threat programme (ITP), many of which seem rather Orwellian. Indeed, they argue that such an approach could create a hostile environment that may actually encourage employees to turn against the organization. Instead, they argue, the issue of insider threats, and how to prevent them, should be approached as just as much an HR issue as a technical one – and this is the philosophy behind the ITP they built at Forcepoint. In their paper, they share some of the lessons they learned in rolling out their ITP within the company.
Even if insider threats are not something you're particularly concerned about, there are important lessons to be learned from this paper, which are that not every security problem is a technical one, and that non-technical solutions can have a great impact.
Register for VB2017 now to hear Kristin, Richard and more than 50 other speakers discuss the latest threats and how to defend against them.
Or maybe you have your own story of a real inside attack to share? The call for last-minute papers remains open until the end of this week (3 September 2017).
