Home > Special Interests > Enemy at the Water Cooler

Contents

• Part I: Background on Cyber Crime, Insider Threats, and ESM
  Chapter One: Cyber Crime and Cyber Criminals
  . About this Chapter
  . Computer Dependence and Internet Growth
  . The Shrinking Vulnerability Threat Window
  . Motivations for Cyber Criminal Activity
  o Black Markets
  . Hacker
  . Script Kiddies
  . Solitary Cyber Criminals and Exploit Writers for Hire
  . Organized Crime
  . Identity Thieves (Impersonation Fraudsters)
  . Competitors
  . Activist Groups, Nation-State Threats, and Terrorists
  . Activists
  . Nation-State Threats
  o China
  o France
  o Russia
  o United Kingdom
  o United States
  . Terrorists
  . Insiders
  . Tools of the Trade
  o Application-Layer Exploits
  o Botnets
  o Buffer Overflows
  o Code Packing
  o Denial-of-service (DoS) Attacks
  o More Aggressive and Sophisticated Malware
  o Non-wired Attacks and Mobile Devices
  o Password-cracking
  o Phishing
  o Reconnaissance and Googledorks
  o Rootkits and Keyloggers
  o Social Engineering Attacks
  o Voice over IP (VoIP) Attacks
  o Zero-Day Exploits
  . Summary Points
  Chapter Two: Insider Threats
  . Understanding Who the Insider Is
  . Psychology of Insider Identification
  . Insider Threat Examples from the Media
  . Insider Threats from a Human Perspective
  o A Word on Policies
  . Insider Threats from a Business Perspective
  o Risk
  . Insider Threats from a Technical Perspective
  o Need-to-know
  o Least Privileges
  o Separation of Duties
  o Strong Authentication
  o Access Controls
  o Incident Detection and Incident Management
  . Summary Points
  
  Chapter Three: Enterprise Security Management (ESM)
  . ESM in a Nutshell
  . Key ESM Feature Requirements
  o Event Collection
  o Normalization
  o Categorization
  o Asset Information
  o Vulnerability Information
  o Zoning and Global Positioning System Data
  o Active Lists
  o Actors
  o Data Content
  o Correlation
  o Prioritization
  o Event and Response Time Reduction
  o Anomaly Detection
  o Pattern Discovery
  o Alerting
  o Case Management
  o Real-Time Analysis and Forensic Investigation
  o Visualization
  o High-level Dashboards
  o Detailed Visualization
  o Reporting
  o Remediation
  . Return On Investment (ROI) and Return On Security Investment (ROSI)
  . Alternatives to ESM
  o Do Nothing
  o Custom In-house Solutions
  o Outsourcing and Co-sourcing
  ? Co-sourcing examples:
  . Summary Points
  
  Part II: Real Life Case Studies
  Chapter Four: Imbalanced Security-A Singaporean Data Center
  Chapter Five: Correlating Physical and Logical Security Events-A U.S. Government Organization
  Chapter Six: Insider with a Conscience-An Austrian Retailer
  Chapter Seven: Collaborative Threat-A Telecommunications Company in the U.S.
  Chapter Eight: Outbreak from Within-A Financial Organization in the U.K.
  Chapter Nine: Mixing Revenge and Passwords-A Utility Company in Brazil
  Chapter Ten: Rapid Remediation-A University in the United States
  Chapter Eleven: Suspicious Activity-A Consulting Company in Spain
  Chapter Twelve: Insiders Abridged
  . Malicious use of Medical Records
  . Hosting Pirated Software
  . Pod-Slurping
  . Auctioning State Property
  . Writing Code for another Company
  . Outsourced Insiders
  . Smuggling Gold in Rattus Norvegicus
  
  Part III: The Extensibility of ESM
  Chapter Thirteen: Establishing Chain-of-Custody Best Practices with ESM
  . Disclaimer
  . Monitoring and disclosure
  . Provider Protection Exception
  . Consent Exception
  . Computer Trespasser Exception
  . Court Order Exception
  . Best Practices
  . Canadian Best Evidence Rule
  . Summary Points
  
  Chapter Fourteen: Addressing Both Insider Threats and Sarbanes-Oxley with ESM
  . A Primer on Sarbanes-Oxley
  . Section 302: Corporate Responsibility for Financial Reports
  . Section 404: Management Assessment of Internal Controls
  . Separation of Duties
  . Monitoring Interaction with Financial Processes
  . Detecting Changes in Controls over Financial Systems
  . Section 409: Real-time Issuer Disclosures
  . Summary Points
  
  Chapter Fifteen: Incident Management with ESM
  . Incident Management Basics
  . Improved Risk Management
  . Improved Compliance
  . Reduced Costs
  . Current Challenges
  o Process
  o Organization
  o Technology
  . Building an Incident Management Program
  o Defining Risk
  . Five Steps to Risk Definition for Incident Management
  o Process
  o Training
  o Stakeholder Involvement
  o Remediation
  o Documentation
  . Reporting and Metrics
  . Summary Points
  
  Chapter Sixteen: Insider Threat Questions and Answers
  . Introduction
  . Insider Threat Recap
  . Question One - Employees
  o The Hiring Process
  o Reviews
  o Awareness
  o NIST 800-50
  o Policies
  o Standards
  o Security Memorandum Example
  . Question Two - Prevention
  . Question Three - Asset Inventories
  . Question Four - Log Collection
  o Security Application Logs
  o Operating System Log
  o Web Server Logs
  o NIST 800-92
  . Question Five - Log Analysis
  . Question Six - Specialized Insider Content
  . Question Seven - Physical and Logical Security Convergence
  . Question Eight - IT Governance
  o NIST 800-53
  o Network Account Deletion maps to NIST 800-53 section AC-2
  o Vulnerability Scanning maps to NIST 800-53 section RA-5
  o Asset Creation maps to NIST 800-53 section CM-4
  o Attacks and Suspicious Activity from Public Facing Assets maps to NIST 800-53 section SC-14
  o Traffic from Internal to External Assets maps to NIST 800-53 section SC-7
  . Question Nine - Incident Response
  . Question 10 - Must Haves
  
  Appendix A-Examples of Cyber Crime Prosecutions