На сайте CERT, а именно в блоге " Insider Threat Blog " опубликовали серию из 18 постов, посвященных, как это уже понятно, выявлению и предотвращению угроз информационной безопасности, источником которых являются сотрудники компании или допущенные к обработке внешние лица (например, консультанты, подрядчики и пр.). Вот ссылки на все:
- InTP Series: Establishing an Insider Threat Program (Part 1 of 18)
- InTP Series: Key Elements of an Insider Threat Program (Part 2 of 18)
- InTP Series: The Formalized Program (Part 3 of 18)
- InTP Series: Participation of Business Areas (Part 4 of 18)
- InTP Series: Oversight of Program Compliance and Effectiveness (Part 5 of 18)
- InTP Series: Integration with Enterprise Risk Management (6 of 18)
- InTP Series: Prevention, Detection, and Response (Part 7 of 18)
- InTP Series: Training and Awareness (Part 8 of 18)
- InTP Series: Confidential Reporting (Part 9 of 18)
- InTP Series: Trusted Business Partners (Part 10 of 18)
- InTP Series: Data Collection and Analysis (Part 11 of 18)
- InTP Series: Incident Response Planning (Part 12 of 18)
- InTP Series: Communicating Insider Threat Events (Part 13 of 18)
- InTP Series: Policies, Procedures, and Practices (Part 14 of 18)
- InTP Series: Protection of Employee Civil Liberties and Privacy Rights (Part 15 of 18)
- InTP Series: The Insider Threat Framework (Part 16 of 18)
- InTP Series: Implementation Planning (Part 17 of 18)
- InTP Series: Conclusion and Resources (Part 18 of 18)
Заметки совсем короткие, и на их изучение у вас уйдет совсем немного времени. Каких-то совсем крутых наработок, честно говоря, "зажали" (в каждом посте намекают, чтобы купили у них и прошли курс "Insider Threat Program Manager"). Но все же полезного из этих заметок можно взять много.
Данные рекомендации полезно читать совместно со "стареньким" гайдом CERT " Common Sense Guide to Mitigating Insider Threats, 4th Edition " (2012-12), который до сих пор остается актуальным (регулярно пересматривается).
Напомню, что общая методология CERT рассматривает 3 типа инсайдерских угроз: кража конфиденциальной информации, мошенничество и саботаж. Вот аналитика CERT по этим угрозам за 2012 год:
Также имеет смысл напомнить, что под злонамеренным инсайдером CERT подразумевает сотрудника или внешнего подрядчика, имеющего разрешенный доступ к информации, информационным системам или сети и использует его для нарушения конфиденциальности, целостности или доступности информации или информационных систем.
The CERT Program’s definition of a malicious insider is a current or former employee, contractor, or business partner who meets the following criteria:
- has or had authorized access to an organization’s network, system, or data
- has intentionally exceeded or intentionally used that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization’s information or information systems.
Но вернемся к заметкам в блоге. Коллеги из CERT предлагают строить защиту от инсайдеров путем разработки соответствующей комплексной программы - Insider Threat Program (InTP).
"A formalized insider threat program demonstrates the commitment of the organization to due care and due diligence in the protection of its critical assets. A formal program is essential to providing consistent and repeatable prevention, detection, and responses to insider incidents in an organization. These mature and well defined processes, designed with input from legal counsel and stakeholders across the organization, ensure that employee privacy and civil liberties are protected."
И рассматривают этот вопрос со всех сторон:
Но наиболее полезными я бы отметил следующие заметки:
С точки зрения предотвращения, выявления и реагирования на угрозы инсайдеров коллеги из CERT предлагают ориентироваться на следующие технические меры:
- Network Defenses. Network defenses include protection systems such as data loss prevention (DLP), intrusion detection and prevention (IDS/IPS), proxies, packet inspection, and email monitoring. Your organization may already have such systems in place to defend against external threat actors. However, with some additional configuration, these systems can be used for insider threat prevention and/or detection purposes as well. For example, web and application proxy logs are an excellent source that can be used for monitoring employee activities and alerting of those that may be of concern.
- Host Defenses. Host defenses include protections such as session timeouts, access control, and application logs. These defenses can be reconfigured to protect against insiders attempting to access systems or information outside of their need-to-know.
- Physical Defenses. Physical defenses include components such as badging systems and physical media destruction, which can establish physical movement patterns and help safeguard physical systems and storage media.
- Tools and Processes. Tools and processes include components such as account creation, deletion, and expiration policies and configuration management baselines, which can be used to ensure that privileged users are not abusing their level of access.
С точки зрения повышения осведомленности и обучения предлагают 5 типов тренингов:
- General insider threat awareness training for all staff that provides insight into what insider threats are and how they should be reported and handled
- Core training for InTP team members and governance bodies that covers how they should perform their key activities and functions, including related processes, tools, and policies
- Role-based training for those involved in insider threat prevention, detection, and resolution, including but not limited to human resources, Information Technology, legal, physical security and personnel security staff
- Specialized training for staff who access classified information that covers their responsibility to report suspicious behaviors, protect sensitive information, and follow information disclosure and data classification schemes
- Specialized training for managers and supervisors that helps them understand their role in the InTP, identify behavioral precursors to malicious insider activities, coach and manage employees, and ensure employees get appropriate assistance as needed
В одной из заметок представлена схема про сбор логов (это, кстати, одна из важнейших задач при построении системы защиты от внутренних угроз):
Еще даются рекомендации по построению процедуры реагирования на инциденты:
- Responses must be documented and practiced consistently.
- All response procedures should be coordinated with General Counsel (это руководитель юридического департамента).
- Privacy and civil liberties must be considered in response procedures.
- All inquiries should receive a disposition after a reasonable period of inactivity.
- All inquiries should have a retrievable record after their disposition.
- Until anomalies or allegations are substantiated, the name of the individual must be kept confidential and not revealed outside of the personnel who are authorized to resolve insider threat concerns.
И советы по документированию политик и процедур:
The following are some general policies, procedures, and practices that should be in place to operate an InTP:
- an approved organization-wide insider threat policy that is applicable to employees, contractors, and trusted business partners
- a defined mission and function for the InTP
- an incident response plan that accommodates insider incidents
- policies and procedures detailing the data collection and aggregation process
- policies and procedures for user monitoring
- a financial plan and budget for the InTP
- a policy and procedure requiring the inventory of high-value assets and their criticality
- supporting policies, such as procedures for investigating suspicious actions by employees, anonymous reports, or potential insider threat activities
Other policies, procedures, and practices that should be in place for different areas of the organization such as Human Resources, Legal, Counter Intelligence, Information Technology, physical security, data owners, and others who are part of the organizational-wide program:
- acceptable use policy (кстати, я про этот документ писал тут )
- data retention policy
- access control policies and procedures
- account auditing policies and procedures
- data controls governing data destruction and corresponding policies and procedures
- background screening policies and procedures
- hiring and employee separation policies and procedures
- physical security policies and procedures
- foreign travel policies and procedures
По сути в заметках CERT представлены скорее верхнеуровневые идеи и советы, но зато вопрос защиты от угроз инсайдеров рассмотрен со всех сторон. Так что я все же рекомендую с ними ознакомиться.
Кстати, аналогичную подборку материала коллеги из CERT делали еще и в 2013 году, тогда она называлась "Common Sense Guide to Mitigating Insider Threats - Best Practice" и состояла из 19 постов (вот ссылка на первый ).
P.S. А еще можете посмотреть:
P.S. А еще можете посмотреть:
