What are the proper procedures for handling a potential insider threat?

In this SearchSecuity.com Q&A, Mike Rothman discusses how corporations can avoid insider threats by forming an incident response plan and monitoring employee behavior.

Mike Rothman, Securosis

MIS/employee support staffs have access to sensitive enterprise and personal information. As a security team, what measures should we recommend if we suspect that they aren't following proper security procedures?

The issue of handling insider bad behavior should fall under an organization's incident response plan. If sensitive and/or personal data might have been compromised, it's a possible incident. As with any incident, the rules of engagement should be defined before there is an issue. That means a documented plan that has been agreed upon by all of the applicable influencers; including legal and human resources groups.

The first thing to do is investigate the issue. Locking down devices and/or denying data access to suspected staff...

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please log in.

You have exceeded the maximum character limit.

Please provide a Corporate Email Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

members is one way to go, but that would be a sure tip-off. In most cases, monitoring employee activity and building a case is the most productive plan of action. Keep in mind, this should not be done alone: legal and HR groups need to be involved to make sure any remediation, sanction or other activity is handled legally and within corporate policies.

Once enough information is gathered to prove foul play, then it will be up to the powers that be to handle the situation. Depending on the nature of the transgression, law enforcement may be brought in. In all cases, the documentation and other information that was used to build the case will need to be provided.

Prosecuting an incident is one of the worst parts of being in the security business. But it's critical and unfortunately it's usually best to make a public example of the transgression. You may or may not believe in the power of a "public execution" as a deterrent to future bad behavior – but I do. I've seen it work.

For more information:

In this Ask the Expert Q&A, Shon Harris provides resources you can use to devise an effective incident response plan.
Learn how Creating a security awareness program can help thwart the insider threat.

This was last published in September 2007

How automating incident response benefits security programs

ICO data raises doubts over UK firms’ ability to manage breaches

Government data requests rise, as does Apple's compliance

Finland government to review public procurement laws

Dig Deeper on Information Security Incident Response-Information

How automating incident response benefits security programs

ICO data raises doubts over UK firms’ ability to manage breaches

Government data requests rise, as does Apple's compliance

Finland government to review public procurement laws

Related Q&A from Mike Rothman

How to prevent software piracy

What are the roles and responsibilities of a liaison officer?

What's the best career path to get CISSP certified?