In the Defense Industrial Base in particular, corporate executives are on edge these days, anticipating the next game changing crisis phone call from the General Counsel. The conversation is one that every CxO expects to have at some point in their career, yet the pace of multi-million dollar incidents is rapidly increasing. The origin typically begins somewhere within the Operational Risk Management (ORM) landscape including People, Processes, Systems or External events.
INTRODUCTION
The Board of Directors are evaluating the current funding levels for Operational Risk Management programs. The focus on "Insider Threat" is a renewed area of scrutiny in light of the number of intellectual property thefts and national security classified information leaks. This means increased funding potential for programs of Defensive Counterintelligence. Next we shall look at the strategic challenges involving Homeland Security, Domestic Intelligence and Technological Innovation.
STRATEGIC CHALLENGES
You may have heard that Corporate Security and Operational Risk Officers are consistently using the acronym M.I.C.E. to describe the motivations for rogue insider employees. Money, Ideology, Compromise and Ego are the main categories that human behavior can be associated with, when the realization that an incident has occurred.
The "Why" question is asked early on by the General Counsel and the Chief Risk Officer (CRO), to try and understand the motivation by the employee.
One challenge is the current ecosystem of Homeland Security in the United States. Consistently oriented on the protection of catastrophic threats to the homeland in general and not to an individual company, much of the Homeland Security Intelligence (HSI mechanism is myopic and not predictive. The laws associated with U.S. persons and the current state of employee protections is a white paper in itself. However, the scrutiny of laws associated with the theft of intellectual property and corporate trade secrets is gaining momentum.
The challenges of "Domestic Intelligence" and the intersection of "Technological Innovation" is now on a collision course in the courts. Previous legal decisions such as United States v. Jones, 132 S. Ct. 945, 565 U.S. ___ (2012) was a Supreme Court Case that sets an example. As interpretations of the constitutional rights of U.S. citizens are decided where the legal evidence of metadata is collected from technology innovations and is deemed to violate those rights, the challenges for domestic intelligence applications become more apparent. This includes law enforcement and internal corporate security programs within the private sector enterprises.
CORPORATE CULTURE ISSUES
There are three competing perspectives within the enterprise organization that present a continuous cultural tug-of-war:
Even though the U.S. does not have anything close to the EU Data Protection Directive, the legal precedents are being played out in the courts. In the U.S., workplace privacy is a rapidly evolving spectrum of technology, metadata and big data analytics:
The "Insider Threat" and Defensive Counterintelligence strategies are up against the employee privacy and data governance legal battles in the U.S.. However, there is a a way forward to design the future architecture for this particular Operational Risk Management domain, beyond more legally detailed "Acceptable Use Agreements".
Just as any agreement on standards or rules takes a process and a dedicated architecture, so will this arena of human behavior, technology innovations and vital digital information assets. Effective and transparent "Trust Decisions" that become embedded in the architecture to enable application of the agreed upon rulesets, is the ultimate goal. Once humans have the confidence in a mechanism for making these Trust Decisions consistently and with integrity, the presence of prudent risk management will then be realized.
The private sector will lead this effort in collaboration with government, yet it will design it's own protocols and rulesets to plug-in to new federal standards. The application of continuous monitoring of threats within the private sector workplace will evolve quickly by using these new frameworks and new tools. Trust Decisions will be made in milliseconds, as systems execute the rules that have been coded into software and the latest big data analytics logic.
We recommend that the private sector continue to establish a consortium of cross-sector companies to interface with the new ISE.gov framework entitled "The Data Aggregation Reference Architecture."
The international agreements on ISO standards has a long history. Quality and Environmental standards are most common. The 21st century has delivered us privacy and information security "management system" standards established and agreed upon internationally. The standards and rulesets integrated with government shall have interoperability with the private sector. The private sector shall collaborate with government on the architecture for information sharing. The future state outcomes will enhance our trust in the management systems that have been designed from the ground up, to execute the rules. A good example from ISO follows:
The future of the "Insider Threat" solutions will not be designed by just one company or one government. Just as the Internet standards that have evolved to support billions of IP addressable devices using data science and machine learning, so too will the private sector discover the way forward on transparency and data governance. What are the odds that an "Insider Actor" hired at company "A" may then move to Company "B" once and if they determine the controls and processes are too difficult or will catch them in their unauthorized activities?
The safety, security and privacy of our organizations in concert with an international community is imperative. People must believe in the integrity of the "Trust Decisions" being made each second by the Internet devices they hold in their hands and simultaneously by the organizations they devote their working lives to each day.
INTRODUCTION
The Board of Directors are evaluating the current funding levels for Operational Risk Management programs. The focus on "Insider Threat" is a renewed area of scrutiny in light of the number of intellectual property thefts and national security classified information leaks. This means increased funding potential for programs of Defensive Counterintelligence. Next we shall look at the strategic challenges involving Homeland Security, Domestic Intelligence and Technological Innovation.
STRATEGIC CHALLENGES
You may have heard that Corporate Security and Operational Risk Officers are consistently using the acronym M.I.C.E. to describe the motivations for rogue insider employees. Money, Ideology, Compromise and Ego are the main categories that human behavior can be associated with, when the realization that an incident has occurred.
The "Why" question is asked early on by the General Counsel and the Chief Risk Officer (CRO), to try and understand the motivation by the employee.
One challenge is the current ecosystem of Homeland Security in the United States. Consistently oriented on the protection of catastrophic threats to the homeland in general and not to an individual company, much of the Homeland Security Intelligence (HSI mechanism is myopic and not predictive. The laws associated with U.S. persons and the current state of employee protections is a white paper in itself. However, the scrutiny of laws associated with the theft of intellectual property and corporate trade secrets is gaining momentum.
The challenges of "Domestic Intelligence" and the intersection of "Technological Innovation" is now on a collision course in the courts. Previous legal decisions such as United States v. Jones, 132 S. Ct. 945, 565 U.S. ___ (2012) was a Supreme Court Case that sets an example. As interpretations of the constitutional rights of U.S. citizens are decided where the legal evidence of metadata is collected from technology innovations and is deemed to violate those rights, the challenges for domestic intelligence applications become more apparent. This includes law enforcement and internal corporate security programs within the private sector enterprises.
CORPORATE CULTURE ISSUES
There are three competing perspectives within the enterprise organization that present a continuous cultural tug-of-war:
- Human Resources
- Privacy & Legal Governance
- Security & Risk Management
Even though the U.S. does not have anything close to the EU Data Protection Directive, the legal precedents are being played out in the courts. In the U.S., workplace privacy is a rapidly evolving spectrum of technology, metadata and big data analytics:
Employees typically must relinquish some of their privacy while at the workplace, but how much they must do so can be a contentious issue. The debate rages on as to whether it is moral, ethical and legal for employers to monitor the actions of their employees. Employers believe that monitoring is necessary both to discourage illicit activity and to limit liability. Although, with this problem of monitoring of employees, many are experiencing a negative effect on emotional and physical stress including fatigue and lack of motivation within the workplace.RECOMMENDATIONS
The "Insider Threat" and Defensive Counterintelligence strategies are up against the employee privacy and data governance legal battles in the U.S.. However, there is a a way forward to design the future architecture for this particular Operational Risk Management domain, beyond more legally detailed "Acceptable Use Agreements".
Just as any agreement on standards or rules takes a process and a dedicated architecture, so will this arena of human behavior, technology innovations and vital digital information assets. Effective and transparent "Trust Decisions" that become embedded in the architecture to enable application of the agreed upon rulesets, is the ultimate goal. Once humans have the confidence in a mechanism for making these Trust Decisions consistently and with integrity, the presence of prudent risk management will then be realized.
The private sector will lead this effort in collaboration with government, yet it will design it's own protocols and rulesets to plug-in to new federal standards. The application of continuous monitoring of threats within the private sector workplace will evolve quickly by using these new frameworks and new tools. Trust Decisions will be made in milliseconds, as systems execute the rules that have been coded into software and the latest big data analytics logic.
We recommend that the private sector continue to establish a consortium of cross-sector companies to interface with the new ISE.gov framework entitled "The Data Aggregation Reference Architecture."
The need for greater interoperability is clear. To protect national interests, intelligence and law enforcement agencies must be able to collect, accurately aggregate, and share real-time analytical information about people, places, and events in a manner that also protects privacy, civil rights, and civil liberties. The President’s National Strategy for Information Sharing and Safeguarding (NSISS) recognizes this as a priority national security issue, and speaks directly to this challenge. The Data Aggregation Reference Architecture (DARA) is in direct response to NSISS Priority Objective 10, “Develop a reference architecture to support a consistent approach to data discovery and entity resolution and data correlation across disparate datasets,” The DARA provides a reference architecture that can enable rapid information sharing, particularly forThese private sector companies need to standardize across sectors, just as the government is embarking on the mission to improve this across agencies. You see, the blind spots that the government has discovered in sharing information across it's own departments and agencies is no different in private industry. The failure of Energy companies sharing information with other Energy companies or the same within the Financial Services industry ISAC model is not new. However, the speed and integrity of future "Trust Decisions" on Insider Threats will always depend on the timeliness and quality of the data.
correlated data, but also for raw data, by providing a framework for interoperability between systems, applications and organizations.
The international agreements on ISO standards has a long history. Quality and Environmental standards are most common. The 21st century has delivered us privacy and information security "management system" standards established and agreed upon internationally. The standards and rulesets integrated with government shall have interoperability with the private sector. The private sector shall collaborate with government on the architecture for information sharing. The future state outcomes will enhance our trust in the management systems that have been designed from the ground up, to execute the rules. A good example from ISO follows:
Cloud computing is quite possibly the hottest, most discussed and often misunderstood topic in IT today. This revolutionary concept has reached unexpected heights in the last decade and is recognized by governments and private-sector organizations as major game-changing technology.CONCLUSION
In the January/February 2015 ISOfocus issue, we address some of the basic questions surrounding cloud computing (including the savings and business utility the technology can offer). We also explore security concerns of the cloud services industry and how these are addressed by ISO/IEC 27018, the first International Standard on safeguarding personal data in the cloud.
The future of the "Insider Threat" solutions will not be designed by just one company or one government. Just as the Internet standards that have evolved to support billions of IP addressable devices using data science and machine learning, so too will the private sector discover the way forward on transparency and data governance. What are the odds that an "Insider Actor" hired at company "A" may then move to Company "B" once and if they determine the controls and processes are too difficult or will catch them in their unauthorized activities?
The safety, security and privacy of our organizations in concert with an international community is imperative. People must believe in the integrity of the "Trust Decisions" being made each second by the Internet devices they hold in their hands and simultaneously by the organizations they devote their working lives to each day.
