Insider Risk

An "insider" refers to a current or former employee, contractor, or business partner who has or had authorized access to an organization's network, system, data, or facilities. They may misuse this access to negatively impact the confidentiality, integrity, or availability of the organization's information, information systems, business processes, employee safety, or asset security. Insiders often possess unique information and knowledge that would be challenging for an external attacker to obtain, such as specific security implementations, personnel procedures, patterns of life, equipment malfunctions, or uncorrected vulnerabilities.

There are three main categories of insider:

• The passive insider might pass information to an outsider to assist in accomplishing its goal. This assistance might be intentional, or unintentional. (A good example of an unintentional passive insider is someone who clicks a link in an email which unleashes a malware attack.)

• The second category is the active nonviolent insider. This person can act alone, or in concert with an outsider. They are willing to steal, disrupt, and commit fraud and espionage, but stop short of violence.

• Finally, the active violent insider seeks to cause significant physical damage to an organization's security, systems, and critical assets. They are prepared to take extreme risks, including risking their life and using deadly force or weapons, to achieve their mission. The worst form of this is the workplace active shooter.

Every organization should consider their insider risks, and may elect to set up an insider risk mitigation program. There is a lot of good material available from the federal governments in Canada and the US.

• Click here for CISA’s mitigation guide

• Click here for Public Safety Canada’s mitigation guide and here to request their risk survey tool

• A high-level guide to the 8 recommended security actions to reduce insider risk is available from Public Safety Canada here

If you have any questions or comments about insider risk mitigation planning, please let me know.

Our critical infrastructure assets were built for a world that doesn't exist anymore

Electric sector assets were, for the most part, built a long time ago. A couple of facts to illustrate:

• according to T&D World, the “average age of installed large transformers in the US is about 40 years”

• in an excellent primer on how the US power grid works, the Council on Foreign Relations says that the average age of power plants is over thirty years old

The past forty years have seen huge changes in technology, climate, and society. The world is hotter, weather is more violent, and the people on the angry fringes of society are better organized and informed. Information that used to be the realm of a few is now available almost instantly. Misinformation and disinformation are even faster.

So what does this mean? This link will take you to an impact/frequency chart. Recent changes to climate and technology has forced many of the events that were typically in the High Impact / Low Frequency (HILF) quadrant a lot closer to the High Impact / Hi Frequency quadrant (HIHF). Events are not only happening more often, they’re getting more dangerous too.

So what does this mean to critical infrastructure owners and operators? Organizations that expect high impact events to only happen rarely are usually structured and funded with that in mind, and managing these risks fall to a support department, such as security, safety, or contingency planning. HIHF events, as they are both dangerous and much more common, are usually managed by Operation, where more funding, manpower and oversight is available.

The bottom line is that infrastructure owners and operators may need to reconsider funding, oversight, and manpower resources to provide a level of protection in keeping with the evolving threats to their assets.