))
Leveraging Open Source Intelligence in Insider Threat Programs with Vaillance Group CEO, Shawnee Delaney
Manage episode 341165643 series 3331602
Content provided by Nisos, Inc.. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Nisos, Inc. or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.
In episode 81 of The Cyber5, we are joined by the Head of Insider Threat at Uber and CEO of Vaillance Group, Shawnee Delaney.
In this episode, we provide an overview of different functions within an insider threat program. We also discuss the support open source intelligence provides to such programs and how to change company culture to care about insider threats. We also discuss the ROI metrics that are important to different stakeholders when implementing an insider threat program.
Three Takeaways:
- Departments and Functions within Insider Threat
Insider threat programs are relatively new in enterprise security and often change from company to company. Open source intelligence can be a standalone role or be cross functional among all departments. Common departments and functions can be:
- Open source intelligence.
- Forensics monitoring.
- Training and awareness (steering committees for stakeholders, benchmarking).
- Technical and behavioral monitoring (UEBA or DLP).
- Supplier due diligence.
- Global investigations.
- Global intelligence analysis.
2) Common Problems Faced by Insider Threat Teams
Common challenges faced by insider threat teams:
- Privacy to ensure employee confidentiality is not violated.
- Tooling to have visibility into malicious events from normal behavior.
- Finding practitioners that can do the technical monitoring and open source intelligence.
- Shifting culture to be more security conscious.
- Focus on physical security issues, like active shooter situations, just as much as data exfiltration and other cyber concerns.
3) Role of Open Source intelligence in Insider Threat Programs
An Insider threat program is a key stakeholder for a threat intelligence program, not the individual buyer. Three key areas where open source intelligence (OSINT) supports insider threat programs:
- Employee lifecycle management: ensuring employees, former employees, and prospects are not an insider threat based on what they post on the internet.
- Validating red flag indicators with OSINT.
- Investigations into vendors.
91 episodes
Share
