The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud)

( 1 )

Overview

Since 2001, the CERT® Insider Threat Center at Carnegie Mellon University’s Software Engineering Institute (SEI) has collected and analyzed information about more than seven hundred insider cyber crimes, ranging from national security espionage to theft of trade secrets. The CERT® Guide to Insider Threats describes CERT’s findings in practical terms, offering specific guidance and countermeasures that can be immediately applied by executives, managers, security officers, and operational staff within any private, ...

See more details below
Hardcover (New Edition)
$45.88
BN.com price
(Save 16%)$54.99 List Price
Other sellers (Hardcover)
  • All (8) from $41.47   
  • New (5) from $41.47   
  • Used (3) from $41.67   
The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud)

Available on NOOK devices and apps  
  • NOOK Devices
  • Samsung Galaxy Tab 4 NOOK 7.0
  • Samsung Galaxy Tab 4 NOOK 10.1
  • NOOK HD Tablet
  • NOOK HD+ Tablet
  • NOOK eReaders
  • NOOK Color
  • NOOK Tablet
  • Tablet/Phone
  • NOOK for Windows 8 Tablet
  • NOOK for iOS
  • NOOK for Android
  • NOOK Kids for iPad
  • PC/Mac
  • NOOK for Windows 8
  • NOOK for PC
  • NOOK for Mac

Want a NOOK? Explore Now

NOOK Book (eBook)
$25.49
BN.com price
(Save 42%)$43.99 List Price

Overview

Since 2001, the CERT® Insider Threat Center at Carnegie Mellon University’s Software Engineering Institute (SEI) has collected and analyzed information about more than seven hundred insider cyber crimes, ranging from national security espionage to theft of trade secrets. The CERT® Guide to Insider Threats describes CERT’s findings in practical terms, offering specific guidance and countermeasures that can be immediately applied by executives, managers, security officers, and operational staff within any private, government, or military organization.

The authors systematically address attacks by all types of malicious insiders, including current and former employees, contractors, business partners, outsourcers, and even cloud-computing vendors. They cover all major types of insider cyber crime: IT sabotage, intellectual property theft, and fraud. For each, they present a crime profile describing how the crime tends to evolve over time, as well as motivations, attack methods, organizational issues, and precursor warnings that could have helped the organization prevent the incident or detect it earlier. Beyond identifying crucial patterns of suspicious behavior, the authors present concrete defensive measures for protecting both systems and data.

This book also conveys the big picture of the insider threat problem over time: the complex interactions and unintended consequences of existing policies, practices, technology, insider mindsets, and organizational culture. Most important, it offers actionable recommendations for the entire organization, from executive management and board members to IT, data owners, HR, and legal departments.

With this book, you will find out how to

  • Identify hidden signs of insider IT sabotage, theft of sensitive information, and fraud
  • Recognize insider threats throughout the software development life cycle
  • Use advanced threat controls to resist attacks by both technical and nontechnical insiders
  • Increase the effectiveness of existing technical security tools by enhancing rules, configurations, and associated business processes
  • Prepare for unusual insider attacks, including attacks linked to organized crime or the Internet underground

By implementing this book’s security practices, you will be incorporating protection mechanisms designed to resist the vast majority of malicious insider attacks.

Read More Show Less

Editorial Reviews

From the Publisher

“For years, researchers at the CERT Insider Threat Center at Carnegie Mellon’s Software Engineering Institute have been collecting and studying data on real-world insider incidents. This year, they published a book cataloging the results of their research, called The CERT Guide to Insider Threats. This book is an invaluable guide to establishing effective processes for managing the risk of insider attacks, and it should be on every security professional’s wish list this year. In general, the insider threat drives home the point that perimeter defenses are no longer enough. IT organizations also need to be able to see into their internal networks to identify suspicious activity.”

-- Tom Cross, Director of Security Research at Lancope, guest writing for Forbes CIO Central

Read More Show Less

Product Details

  • ISBN-13: 9780321812575
  • Publisher: Addison-Wesley
  • Publication date: 2/9/2012
  • Series: SEI Series in Software Engineering Series
  • Edition description: New Edition
  • Edition number: 1
  • Pages: 432
  • Sales rank: 638,065
  • Product dimensions: 7.20 (w) x 9.20 (h) x 1.40 (d)

Meet the Author

Dawn Cappelli, CISSP, is Technical Manager of the CERT Insider Threat Center and the Enterprise Threat and Vulnerability Management Team at Carnegie Mellon University’s Software Engineering Institute (SEI). She has spent the past decade working with organizations such as the U.S. Secret Service and Department of Homeland Security in protecting the United States against insider threats. Andrew Moore is Lead Researcher in the CERT Insider Threat Center and Senior Member of Technical Staff at SEI. Randall Trzeciak is a Senior Member of Technical Staff at SEI, and Technical Team Lead for the Insider Threat Research Group at the CERT Insider Threat Center.

Read More Show Less

Table of Contents

Preface xvii

Acknowledgments xxxi

Chapter 1: Overview 1

True Stories of Insider Attacks 3

The Expanding Complexity of Insider Threats 6

Breakdown of Cases in the Insider Threat Database 7

CERT’s MERIT Models of Insider Threats 9

Overview of the CERT Insider Threat Center 13

Timeline of the CERT Program’s Insider Threat Work. 16

Caveats about Our Work 20

Summary 20

Chapter 2: Insider IT Sabotage 23

General Patterns in Insider IT Sabotage Crimes 28

Mitigation Strategies 46

Summary 59

Chapter 3: Insider Theft of Intellectual Property 61

Impacts 66

General Patterns in Insider Theft of Intellectual Property Crimes 68

The Entitled Independent 69

The Ambitious Leader 78

Theft of IP inside the United States Involving Foreign Governments or Organizations 83

Mitigation Strategies for All Theft of Intellectual Property Cases 88

Mitigation Strategies: Final Thoughts 97

Summary 98

Chapter 4: Insider Fraud 101

General Patterns in Insider Fraud Crimes 106

Insider Fraud Involving Organized Crime 115

Organizational Issues of Concern and Potential Countermeasures 120

Mitigation Strategies: Final Thoughts 126

Summary 127

Chapter 5: Insider Threat Issues in the Software Development Life Cycle 129

Requirements and System Design Oversights 131

System Implementation, Deployment, and Maintenance Issues 136

Programming Techniques Used As an Insider Attack Tool 139

Mitigation Strategies 142

Summary 143

Chapter 6: Best Practices for the Prevention and Detection of Insider Threats 145

Summary of Practices 146

Practice 1: Consider Threats from Insiders and Business Partners in Enterprise-Wide Risk Assessments 151

Practice 2: Clearly Document and Consistently Enforce Policies and Controls 155

Practice 3: Institute Periodic Security Awareness Training for All Employees 159

Practice 4: Monitor and Respond to Suspicious or Disruptive Behavior, Beginning with the Hiring Process 164

Practice 5: Anticipate and Manage Negative Workplace Issues 168

Practice 6: Track and Secure the Physical Environment 171

Practice 7: Implement Strict Password- and Account-Management Policies and Practices 174

Practice 8: Enforce Separation of Duties and Least Privilege 178

Practice 9: Consider Insider Threats in the Software Development Life Cycle 182

Practice 10: Use Extra Caution with System Administrators and Technical or Privileged Users 187

Practice 11: Implement System Change Controls 191

Practice 12: Log, Monitor, and Audit Employee Online Actions 195

Practice 13: Use Layered Defense against Remote Attacks 200

Practice 14: Deactivate Computer Access Following Termination 203

Practice 15: Implement Secure Backup and Recovery Processes 207

Practice 16: Develop an Insider Incident Response Plan 211

Summary 213

References/Sources of Best Practices 214

Chapter 7: Technical Insider Threat Controls 215

Infrastructure of the Lab 217

Demonstrational Videos 218

High-Priority Mitigation Strategies 219

Control 1: Use of Snort to Detect Exfiltration of Credentials Using IRC 220

Control 2: Use of SiLK to Detect Exfiltration of Data Using VPN 221

Control 3: Use of a SIEM Signature to Detect Potential Precursors to Insider IT Sabotage 223

Control 4: Use of Centralized Logging to Detect Data Exfiltration during an Insider’s Last Days of Employment 231

Insider Threat Exercises 239

Summary 239

Chapter 8: Case Examples 241

Sabotage Cases 241

Sabotage/Fraud Cases 256

Theft of IP Cases 258

Fraud Cases 262

Miscellaneous Cases 269

Summary 273

Chapter 9: Conclusion and Miscellaneous Issues 275

Insider Threat from Trusted Business Partners 275

Malicious Insiders with Ties to the Internet Underground 286

Final Summary 293

Appendix A: Insider Threat Center Products and Services 299

Appendix B: Deeper Dive into the Data 307

Appendix C: CyberSecurity Watch Survey 319

Appendix D: Insider Threat Database Structure 325

Appendix E: Insider Threat Training Simulation: MERIT InterActive 333

Appendix F: System Dynamics Background 345

Glossary of Terms 351

References 359

About the Authors 365

Index 369

Read More Show Less

Customer Reviews

Average Rating 4
( 1 )
Rating Distribution

5 Star

(0)

4 Star

(1)

3 Star

(0)

2 Star

(0)

1 Star

(0)

Your Rating:

Your Name: Create a Pen Name or

Barnes & Noble.com Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & Noble.com that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & Noble.com does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at BN.com or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation

Reminder:

  • - By submitting a review, you grant to Barnes & Noble.com and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Noble.com Terms of Use.
  • - Barnes & Noble.com reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & Noble.com also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on BN.com. It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

 
Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously
Sort by: Showing 1 Customer Reviews
  • Anonymous

    Posted January 29, 2013

    The book, "The CERT Guide to Insider Threats: How to Preven

    The book, "The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud)" is a very interesting and informative read. This book breaks down and categorizes insider threats into three categories which are: 1) Insider IT Sabotage, 2) Insider Theft of Intellectual Property and 3) Insider Fraud. This breakdown simplifies deciding what kinds of insider threats exist for the reader.

    I think the book's idea of linking particular events listed in human resource records, particularly those of system and network administrators, as automatic triggers for IT Security audits is an excellent idea. This book has thoroughly and successfully presented it's theory that a correlation between a system and network administrator's downward slide in their behavior as reflected by their human resource's record and their
    potential as a disgruntled employee that could be a potential insider threat exists. This book's presentation of the many documented cases where disgruntled employees who became insider threats actually carried out attacks categorized into one of the three above mentioned categories, solidly supports this theory.

    I would really like to suggest automatically activating an IT Security audit of any system and network administrator who appears to be disgruntled as reflected by their human resource records to my company. Such an automatically activated audit would be an excellent way to prevent someone with elevated privileges from carrying out an insider attack. However, the sad reality is, I don't think many companies would
    dedicate the time & money needed to implement such a program, until this correlation could be accurately quantified in terms of justifying how it would save the company money. Quantifying the value of proactive IT Security is the most difficult thing about justifying it's existence. Perhaps the next step in proving this theory would be to quantify exactly in terms of dollars and cents how much money a company could save by
    implementing this program.

    Overall though, I believe this book could be valuable to anyone involved in IT Security. Even if a company chose not to implement an automatic IT Security audit of a network or system administrator who looks like they may be on their way out, the information presented in this book could really help any company recognize the warning signs of someone who is disgrunted, who may be turning into an insider threat that may carry out an IT network.

    Was this review helpful? Yes  No   Report this review
Sort by: Showing 1 Customer Reviews

If you find inappropriate content, please report it to Barnes & Noble
Why is this product inappropriate?
Comments (optional)