25 Sep Human Resources Insider Threat Guidelines

As you have previously learned, organizations must implement countermeasures to protect information and data vulnerable to cyberattacks from external and internal sources.

This is the fourth of six sequential projects. In this project, you will research and investigate topics in order to draft guidelines for your assigned organization’s human resources department to help upper management identify insider threats and to forestall future attempts. Topics include investigating hacker psychological profiles and the danger of profiling employees.

You will use your findings to prepare a preliminary set of standards, policies, and/or guidelines for management to use in the event of a perceived insider threat.

There are 14 steps in this project. Begin below to review your project scenario.

Transcript:

Human Resources Insider Threat Guidelines

As you go through the morning’s email, you notice one from your boss that links to an article about the Terry Childs cyber breach case. Childs, an administrator in the San Francisco IT department who had sole control of the city-wide network, refused to provide passwords to anyone else after a dispute with a city official, effectively locking down the network.

“Let’s discuss this,” says your boss at the end of the email, and you proceed to meet with him in his office.

Your boss points out that the Childs case indicates the vulnerability of any network in which one administrator has too much control. “While that isn’t likely to happen here,” the boss says, “we need to ensure that we have the proper standards, policies, and guidelines to ensure the safety of our systems.”

In addition, your boss points out that even though Childs is an “insider,” his actions resemble those of a typical hacker.

You realize that understanding what makes hackers “tick” might be a good basis to set up intrusion prevention initiatives at your company. The boss agrees, and asks you to create a presentation. It will include a typical hacker profile, the characteristics of ethical and unethical hackers, and recommendations in the areas of people, technology, and standards or policy, which can be used by the company to ensure the safety of its systems from internal as well as external threats.

Step 1: Review the Terry Childs Case

Before getting started on the presentation, you will want to first learn about the Terry Childs case. Research the case and write a one-page summary of your findings. Your summary should answer the following questions:

What led to Childs being charged with a crime?

How did his employer respond to his actions? What did it do right and/or wrong?

What could the company have done to better secure its assets?

Your summary should be thorough and include a references page. The information gathered will be used in your final presentation. You will use this summary as Appendix A to your presentation.

Submit the Terry Childs Case Review for feedback.