28. Finally, A Realistic Approach to Insider Threats

<p><span style="font-weight: 400;">In this episode of</span> <em><span style="font-weight: 400;">Cyber Security Inside,</span></em> <span style="font-weight: 400;">Tom and Camille once again speak with Dr. Eric Cole, CEO and Founder of Secure Anchor Consulting. This time, the topic is insider threats. Some insider threats are a result of bad actors, while others stem from more innocent and unwitting insiders.</span></p> <p> </p> <p><span style="font-weight: 400;">What can CISOs do to prevent, detect, and track down these insider threats? Let’s find out. </span></p> <p> </p> <p><strong>Here are some key take-aways:</strong></p> <p> </p> <p><span style="font-weight: 400;">•  There are really two sides of cyber security: prevention and detection. Everything else generally falls under one of these two categories. </span></p> <p> </p> <p><span style="font-weight: 400;">•  You’re going to miss things with prevention technology, which is why you have to have a detection piece in place. And you have to focus on both inbound and outbound traffic if you’re going to detect both outsider and insider threats. </span></p> <p> </p> <p><span style="font-weight: 400;">•  One of the biggest issues with detection is a lack of resources. IT is being bombarded by sometimes thousands of alerts daily, and they’re simply not equipped to handle them all. The proposed solution is to tune down false positives and focus on the biggest threats.</span></p> <p> </p> <p><span style="font-weight: 400;">•  In situations where you can’t possibly address every threat, you have to make sacrifices and choose to address the most impactful threat. </span></p> <p> </p> <p><span style="font-weight: 400;">•  When determining a hierarchy of importance with server-based threats, malicious code that’s impacting the operating system that runs every time you restart the system will take priority over something that isn’t a threat when the computer’s turned off. With network-based threats, again, you need to determine which threat has the most impact and addres