{"id":7093,"date":"2017-03-23T10:30:15","date_gmt":"2017-03-23T18:30:15","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/23\/news-884\/"},"modified":"2017-03-23T10:30:15","modified_gmt":"2017-03-23T18:30:15","slug":"news-884","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/03\/23\/news-884\/","title":{"rendered":"Snowden's ex-boss offers advice on stopping insider threats"},"content":{"rendered":"

<\/p>\n

Credit to Author: Michael Kan| Date: Thu, 23 Mar 2017 10:10:00 -0700<\/strong><\/p>\n

Steven Bay, a former defense contractor, knows a thing or two about insider threats. For a brief period, he was the boss of Edward Snowden, the famous leaker who stole sensitive files from the U.S. National Security Agency. <\/p>\n

Recalling the day he learned Snowden had been behind the NSA leaks<\/a> back in June 2013, Bay said he received texts about the breaking news while in a leadership meeting at a church. The first text said “Sorry man, looks like your worst nightmare came true.” <\/p>\n

Bay was crushed: “I went out into an empty room of the church and I just melted down crying.” <\/p>\n

“Every negative thought you can have, I had,” he said. “I thought I was going to get fired. I thought I was going to go to jail. I\u2019m going to lose my family\u2026 undercover CIA agents are going to get whacked.” <\/p>\n

Fortunately, Bay — who was Snowden’s manager at the time of the NSA hack — wasn\u2019t jailed. But the whole incident did teach him the dangers about insider data theft, and that all companies must take it seriously. <\/p>\n

“When we look at Snowden, it\u2019s a very divisive issue,” he said. “But there are also a lot of lessons we can learn here.” <\/p>\n

Bay spoke Tuesday at the TechIgnite<\/a> event, hosted by the IEEE Computer Society, where he explained tips that companies can use to guard against insider threats. He previously worked at the consulting firm Booz Allen Hamilton, which does work for the NSA. In February 2013, Bay interviewed Snowden for a job at the firm. <\/p>\n

Snowden has said to the press that he actually sought employment at Booz Allen to gain access to NSA\u2019s surveillance program data. <\/p>\n

Bay calls Snowden a “malicious insider” who should be jailed. But stopping someone like him can be tricky. <\/p>\n

In an interview, Bay said Snowden didn\u2019t exhibit any blatant red flags that exposed his intentions in the two months he was employed at Booz Allen as an intelligence analyst. But he did show a couple “yellow flags” that in retrospect hinted something was off. <\/p>\n

Former defense contractor Steven Bay speaks at TechIgnite on March 21, 2017. <\/p>\n

For instance, Snowden had early on asked for access to NSA\u2019s classified PRISM<\/a> surveillance program. Two weeks later, he asked for it again, explaining that the data would help him in his NSA-related work. After he got access to the information, he ended up leaking it to the press. <\/p>\n

Snowden also claimed he had epilepsy and had to take a leave of absence from Booz Allen because of it. Normally, employees will file short-term disability with human resources so they can still receive their wages, Bay said. But Snowden didn\u2019t care to. <\/p>\n

“Wanting leave without pay, instead of short-term disability, was weird,” he said. However, none of these actions were unreasonable either. <\/p>\n

“I had no reason not to trust him,” said Bay, who recalls being \u201cblown away\u201d by Snowden\u2019s technical knowledge when he interviewed him for the job at Booz Allen. <\/p>\n

That\u2019s why it\u2019s important for any organization to have protective measures in place when insiders do strike, he said. <\/p>\n

Snowden ended up successfully stealing a massive number of files about NSA programs. But better technological controls, like system alerts that detect when sensitive data is being moved, could have been used to stop that, Bay said. <\/p>\n

“Perhaps an alert for when a thumb drive gets plugged in,” he added. “Alerting when a thumb drive gets turned on.” <\/p>\n

Or, in a low-tech solution, USB drive ports from the most sensitive computing systems should be removed. <\/p>\n

Companies can consider data loss prevention<\/a> services, which specialize in the monitoring and the protection of sensitive files, Bay said. But another way to guard against insider threats is properly segregating who has access to what. <\/p>\n

For example, staffers who leave a company should have their computer access immediately terminated. In addition, a company\u2019s accounting department shouldn\u2019t have access to the R&D team\u2019s research, and vice-versa.\u00a0 <\/p>\n

“Unless your insider has the keys to the kingdom, they can do damage, but they\u2019ll be limited to whatever they have access to,” he said.\u00a0 <\/p>\n

Following the NSA leaks, Bay was pulled off from his NSA-related work at Booz Allen Hamilton, and he left the firm last year. He now works as an independent cybersecurity consultant, after serving as a CISO at a medical devices maker. <\/p>\n

Looking back at his time at Booz Allen, Bay joked in his talk at TechIgnite: “I don\u2019t know why I was the one guy out of billions of people who got stuck being Snowden\u2019s boss. But I was.” <\/p>\n

He added that insider hackers like Snowden are rare, so it\u2019s important for companies to focus on more common cybersecurity threats too, like those that come from phishing emails<\/a>, he said. <\/p>\n

But that doesn\u2019t mean companies should ignore the insider risk either. <\/p>\n

“These malicious insiders, in my mind, they can do more damage than any other threat you have out there,” he said. \u00a0 <\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Michael Kan| Date: Thu, 23 Mar 2017 10:10:00 -0700<\/strong><\/p>\n

\n
\n

Steven Bay, a former defense contractor, knows a thing or two about insider threats. For a brief period, he was the boss of Edward Snowden, the famous leaker who stole sensitive files from the U.S. National Security Agency.<\/p>\n

Recalling the day he learned Snowden had been behind the NSA leaks<\/a> back in June 2013, Bay said he received texts about the breaking news while in a leadership meeting at a church. The first text said “Sorry man, looks like your worst nightmare came true.”<\/p>\n

Bay was crushed: “I went out into an empty room of the church and I just melted down crying.”<\/p>\n

To read this article in full or to leave a comment, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[714],"class_list":["post-7093","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=7093"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7093\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=7093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=7093"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=7093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}