SLAC Computer Security		Search SLAC
SLAC Home | Computing Home | Computing Outages | Help

Cyber Security Awareness Month

These tips are part of a month long effort to distribute useful computer security information to the SLAC community.

Day 29 - Insider Threats

Thoughts from the Internet Storm Center: I find this to be one of the hardest to mitigate threats in information security. Frequently, fighting insider threats prevents people from doing work. Another problem is that too much restrictions and surveillance leads to distrust between employer and employee. So what's the right balance? What worked for you? In my opinion, the following ideas usually work: Keep good logs. Logs should show who is doing what to your data. In particular, if insiders use admin level access to change data or review user's data. Avoid "loners". Have people work in teams. Not only is this good for cross training in case an employee is out on vacation, but it also provides a second set of eyes to catch intentional or unintentional mistakes. Keep good backups. If things go bad, it's good to be able to recover. Of course, backups are made by insiders as well. Stay in touch with your employees and care about them. Make sure they are paid well and don't have a reason to be mad at you. If they are: make sure you are able to discover issues early. But treating your employees well goes a long way to mitigating insider threats. An even worse problem I don't even dare to cover: Insiders who get blackmailed. Again, if they trust you maybe they will come forward first. But that's a lot of trust. Ideas from some members of the Internet Storm Center community: Separation of duties. For example, setup an auditors group or a backup group that does not share duties with other system administrators or developers. Minimize privileges. Developers usually don't need root access. Use individual credentials. In the unix world, this translates to "use sudo instead of logging in as root". As you setup new accounts, in particular for temporary workers / contractors: Configure them to expire at the date the contract expires. Link user management to payroll. If they are no longer paid, they don't need accounts. Suspend accounts if they haven't been used in a time (2 weeks? depends on how much vacation people have).