Enemy at the Water Cooler

Part I: Background on Cyber Crime, Insider Threats, and ESM
Chapter One: Cyber Crime and Cyber Criminals
• About this Chapter
• Computer Dependence and Internet Growth
• The Shrinking Vulnerability Threat Window
• Motivations for Cyber Criminal Activity
o Black Markets
• Hacker
• Script Kiddies
• Solitary Cyber Criminals and Exploit Writers for Hire
• Organized Crime
• Identity Thieves (Impersonation Fraudsters)
• Competitors
• Activist Groups, Nation-State Threats, and Terrorists
• Activists
• Nation-State Threats
o China
o France
o Russia
o United Kingdom
o United States
• Terrorists
• Insiders
• Tools of the Trade
o Application-Layer Exploits
o Botnets
o Buffer Overflows
o Code Packing
o Denial-of-service (DoS) Attacks
o More Aggressive and Sophisticated Malware
o Non-wired Attacks and Mobile Devices
o Password-cracking
o Phishing
o Reconnaissance and Googledorks
o Rootkits and Keyloggers
o Social Engineering Attacks
o Voice over IP (VoIP) Attacks
o Zero-Day Exploits
• Summary Points
Chapter Two: Insider Threats
• Understanding Who the Insider Is
• Psychology of Insider Identification
• Insider Threat Examples from the Media
• Insider Threats from a Human Perspective
o A Word on Policies
• Insider Threats from a Business Perspective
o Risk
• Insider Threats from a Technical Perspective
o Need-to-know
o Least Privileges
o Separation of Duties
o Strong Authentication
o Access Controls
o Incident Detection and Incident Management
• Summary Points

Chapter Three: Enterprise Security Management (ESM)
• ESM in a Nutshell
• Key ESM Feature Requirements
o Event Collection
o Normalization
o Categorization
o Asset Information
o Vulnerability Information
o Zoning and Global Positioning System Data
o Active Lists
o Actors
o Data Content
o Correlation
o Prioritization
o Event and Response Time Reduction
o Anomaly Detection
o Pattern Discovery
o Alerting
o Case Management
o Real-Time Analysis and Forensic Investigation
o Visualization
o High-level Dashboards
o Detailed Visualization
o Reporting
o Remediation
• Return On Investment (ROI) and Return On Security Investment (ROSI)
• Alternatives to ESM
o Do Nothing
o Custom In-house Solutions
o Outsourcing and Co-sourcing
? Co-sourcing examples:
• Summary Points

Part II: Real Life Case Studies
Chapter Four: Imbalanced Security—A Singaporean Data Center
Chapter Five: Correlating Physical and Logical Security Events—A U.S. Government Organization
Chapter Six: Insider with a Conscience—An Austrian Retailer
Chapter Seven: Collaborative Threat—A Telecommunications Company in the U.S.
Chapter Eight: Outbreak from Within—A Financial Organization in the U.K.
Chapter Nine: Mixing Revenge and Passwords—A Utility Company in Brazil
Chapter Ten: Rapid Remediation—A University in the United States
Chapter Eleven: Suspicious Activity—A Consulting Company in Spain
Chapter Twelve: Insiders Abridged
• Malicious use of Medical Records
• Hosting Pirated Software
• Pod-Slurping
• Auctioning State Property
• Writing Code for another Company
• Outsourced Insiders
• Smuggling Gold in Rattus Norvegicus

Part III: The Extensibility of ESM
Chapter Thirteen: Establishing Chain-of-Custody Best Practices with ESM
• Disclaimer
• Monitoring and disclosure
• Provider Protection Exception
• Consent Exception
• Computer Trespasser Exception
• Court Order Exception
• Best Practices
• Canadian Best Evidence Rule
• Summary Points

Chapter Fourteen: Addressing Both Insider Threats and Sarbanes-Oxley with ESM
• A Primer on Sarbanes-Oxley
• Section 302: Corporate Responsibility for Financial Reports
• Section 404: Management Assessment of Internal Controls
• Separation of Duties
• Monitoring Interaction with Financial Processes
• Detecting Changes in Controls over Financial Systems
• Section 409: Real-time Issuer Disclosures
• Summary Points

Chapter Fifteen: Incident Management with ESM
• Incident Management Basics
• Improved Risk Management
• Improved Compliance
• Reduced Costs
• Current Challenges
o Process
o Organization
o Technology
• Building an Incident Management Program
o Defining Risk
• Five Steps to Risk Definition for Incident Management
o Process
o Training
o Stakeholder Involvement
o Remediation
o Documentation
• Reporting and Metrics
• Summary Points

Chapter Sixteen: Insider Threat Questions and Answers
• Introduction
• Insider Threat Recap
• Question One - Employees
o The Hiring Process
o Reviews
o Awareness
o NIST 800-50
o Policies
o Standards
o Security Memorandum Example
• Question Two - Prevention
• Question Three – Asset Inventories
• Question Four – Log Collection
o Security Application Logs
o Operating System Log
o Web Server Logs
o NIST 800-92
• Question Five – Log Analysis
• Question Six - Specialized Insider Content
• Question Seven – Physical and Logical Security Convergence
• Question Eight – IT Governance
o NIST 800-53
o Network Account Deletion maps to NIST 800-53 section AC-2
o Vulnerability Scanning maps to NIST 800-53 section RA-5
o Asset Creation maps to NIST 800-53 section CM-4
o Attacks and Suspicious Activity from Public Facing Assets maps to NIST 800-53 section SC-14
o Traffic from Internal to External Assets maps to NIST 800-53 section SC-7
• Question Nine - Incident Response
• Question 10 – Must Haves

Appendix A—Examples of Cyber Crime Prosecutions