© SANS Institute 200
!3(I.**J%&8(X%;*#&"/#0%;(-"08+70;+*( 9 © SANS Institute 200
Mitigating Insider Sabotage ?H( (
I.**J%&8*($.9+(#%(6++#(.(60;06"6(*#.;8.&8(%M(/%6,7+U0#K3((Y+.Q( ,.**J%&8*("*".77K($.9+(#$+(M%77%J0;2(/$.&./#+&0*#0/*'( ( W <.9+(7+**(#$.;(H(/$.&./#+&*( W X%;#.0;(J%&8*(#$.#(.&+(M%";8(0;(.(80/#0%;.&K(N:;270*$(%&(M%&+02;P( W Z.6+(%M(#$+(%&2.;0S.#0%;(( W I.##+&;*(%M(7+##+&*(%&(;"6>+&*(N+3231(.....1(@?CDEF1(.>/8+M2P( W Z.6+*(%M(#$+("*+&O*(M.607K(6+6>+&*1(,+#*1(M.9%&0#+(>%%Q*1(+#/3( W Z%(,.**J%&8(.#(.77( ( ( V;(%&8+&(#%(>+(/%;*08+&+8(.([=#&%;2(I.**J%&8\1(.(,.**J%&8(6"*#(/%;#.0;( #$+(M%77%J0;2'( ( W ]0;06"6(7+;2#$'(Z%(7+**(#$.;(@D(/$.&./#+&*( W X&+.#+8(M&%6(.(,.**,$&.*+(N+3231(ZCJ^A&Q-@5;#*_P`( W X%;#.0;*(.#(7+.*#(%;+(M&%6(+./$(%M(#$+(M%77%J0;2(/.#+2%&0+*'(
a,,+&(/.*+(7+##+&(N+3231(!WbP( c%J+&(/.*+(7+##+&(N+3231(.WSP( Z"6>+&(N+3231(AWBP( =,+/0.7(%&(,";/#".#0%;(/$.&./#+&(N+3231(_(1(d(e(f(g(`h(iP(
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 ((((((((((((((((((((((((((((.(,.**J%&8(6.K(;%#(>+(&+"*+8(J0#$0;(#$+(M%77%J0;2(@@(#06+*(.M#+&( , Author retains full rights.
(((((((((((((((((((((W(((((I.**J%&8*(6.K(>+(&+"*+8(+9+&K(@?(,.**J%&8(&+;+J.7*3((]+.;0;2(#$.#(
( `Z%#+W(8%(;%#("*+(#$+(.>%9+(+U.6,7+(.*(.(,.**J%&8( (
j3(I.**J%&8(I&%#+/#0%;(-"08+70;+*( W(I.**J%&8*(.&+(#%(>+(#&+.#+8(.*(/%;M08+;#0.7(0;M%&6.#0%;3((a;8+&(;%( /0&/"6*#.;/+(.&+(+6,7%K++*(#%(209+1(#+77(%&(209+($0;#(#%(#$+0&(,.**J%&8(#%( .;%#$+&(,+&*%;3((R$0*(0;/7"8+*(/%WJ%&Q+&*1(*",+&90*%&*1(M.607K(6+6>+&*1( M&0+;8*(%&(.860;0*#&.#%&*3( W(I.**J%&8*(.&+(;%#(#%(>+(#&.;*60##+8(+7+/#&%;0/.77K("*0;2(*"/$(6+#$%8*( .*(+W6.071(0;*#.;#(6+**.20;2(%&(*%/0.7(6+80.(N+3231(k./+>%%Q1(RJ0##+&1( ]K=,./+1(+#/3P3((!(,.**J%&8(6.K(>+("*+8(#%(2.0;(&+6%#+(.//+**(#%(-+;+&.7( <%*,0#.7O*(&+*%"&/+*("*0;2(.(lIZ1(==c(,&%#+/#+8(*0#+1(+#/3( W(Z+9+&(&+9+.7(.(,.**J%&8(#%(.;K%;+(%9+&(#$+(,$%;+3( W(m%(;%#(J&0#+(K%"&(,.**J%&8(8%J;3( W(m%(;%#(7+.9+(K%"&(,.**J%&8(%;(.([*#0/Q0+(;%#+\(.##./$+8(#%(K%"&(6%;0#%&1( /%6,"#+&(%&(#.,+8(#%(#$+(>%##%6(%M(K%"&(Q+K>%.&83( W(m%(;%#("*+(#$+([n+6+6>+&(I.**J%&8\(M+.#"&+(%M(.,,70/.#0%;*3( W(m%(;%#("*+(K%"&(-+;+&.7(<%*,0#.7(,.**J%&8(J$07+("*0;2(,+&*%;.71(;%;W J%&Q(&+7.#+8(J+>*0#+(.//%";#*3((=0607.&7K1(8%(;%#("*+(,+&*%;.71(;%;WJ%&Q(
&+7.#+8(,.**J%&8*(M%&(K%"&(-+;+&.7(<%*,0#.7(,.**J%&83( © SANS Institute 200 9
W(m%(;%#(*#%&+(K%"&(,.**J%&8(%;(.(6%>07+(8+90/+(N+3231(j7./Q>+&&K1(0I$%;+1( +#/3P(J0#$%"#(+;/&K,#0%;3(
Mitigating Insider Sabotage ?B( (
W(VM(*%6+%;+(8+6.;8*(K%"&(,.**J%&81(&+M+&(#$.#(,+&*%;(#%(#$+( V;M%&6.#0%;(=+/"&0#K(m+,.+;#(.;8(#%(#$0*(8%/"6+;#3( W(VM(K%"(>+70+9+(#$.#(K%"&(,.**J%&8($.*(>++;(/%6,&%60*+81(&+,%&#(8+#.07*( #%(#$+(V;M%&6.#0%;(=+/"&0#K(m+,.+;#(0;(%&8+&(#%(/$.;2+(K%"&( ,.**J%&83( W(!*(,.&#(%M(%;2%0;2(*+/"&0#K(9"7;+&.>070#K(#+*#0;21(#$+(VR(m+,.+;#(6.K( .##+6,#(#%(2"+**("*+&(,.**J%&8*3((VM(.(,.**J%&8(0*(/&./Q+8(8"&0;2(.;( ."80#1(#$+("*+&(J077(>+(&+T"0&+8(#%(/$.;2+(#$+0&(,.**J%&8(066+80.#+7K3( (
((((((((((((((F3A(X%;#0;".;/+( R$0*(,%70/K(0*(.(7090;2(8%/"6+;#(.;8(.*(*"/$(6.K(>+(6%80M0+8(.#(.;K(#06+( >K(#$+(+U+/"#09+(>%.&81(VR(6.;.2+&(%&(#$+($"6.;(&+*%"&/+*(8+,.+;#3( (
((((((((((((((G3A(:;M%&/+6+;#(
( !;K(+6,7%K++(J$%(0*(M%";8(#%($.9+(90%7.#+8(#$0*(,%70/K(6.K(>+(*">4+/#(#%( 80*/0,70;.&K(./#0%;1(",(#%(.;8(0;/7"80;2(#+&60;.#0%;(%&(+6,7%K6+;#3( ( ( Z.6+'((ooooooooooooooooooooooooooooooooooooooooooooooooooooooooo( ( =02;.#"&+'((oooooooooooooooooooooooooooooooooooooooooooooooooooooooo(
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 ( , Author retains full rights.
m.#+'((ooooooooooooooooooooooooooo( ( (
9 © SANS Institute 200
Last Updated: August 22nd, 2013
Upcoming SANS Training
Click Here for a full list of all Upcoming SANS Events by Location SANS Melbourne 2013
Sep 02, 2013 - Sep 07, 2013 Live Event SANS Capital City 2013
Melbourne, AU
Sep 03, 2013 - Sep 08, 2013 Live Event SANS Network Security 2013
Washington, DCUS
Sep 14, 2013 - Sep 23, 2013 Live Event SEC 440 @MCMC Sept 2013
Las Vegas, NVUS
Sep 17, 2013 - Sep 19, 2013 Live Event SANS Forensics Prague 2013
CyberJaya, MY
Oct 06, 2013 - Oct 13, 2013 Live Event SANS Seattle 2013
Prague, CZ
Oct 07, 2013 - Oct 14, 2013 Live Event SANS Bangalore 2013
Seattle, WAUS
Oct 14, 2013 - Oct 26, 2013 Live Event SANS Baltimore 2013
Bangalore, IN
Oct 14, 2013 - Oct 19, 2013 Live Event SEC760 Advanced Exploit Development for Penetration Testers Baltimore, MDUS
Baltimore, MDUS
Oct 14, 2013 - Oct 19, 2013 Live Event GridSecCon 2013
Oct 15, 2013 - Oct 17, 2013 Live Event Healthcare Cyber Security Summit
Jacksonville, FLUS
Oct 17, 2013 - Oct 24, 2013 Live Event Securing the Internet of Things Summit
San Francisco, CAUS
Oct 17, 2013 - Oct 22, 2013 Live Event SANS Tokyo Autumn 2013
San Francisco, CAUS
Oct 21, 2013 - Oct 26, 2013 Live Event October Singapore 2013
Tokyo, JP
Oct 21, 2013 - Nov 02, 2013 Live Event SANS Dubai 2013
Singapore, SG
Oct 26, 2013 - Nov 07, 2013 Live Event FOR572 Advanced Network Forensics and Analysis
Dubai, AE
Oct 28, 2013 - Nov 02, 2013 Live Event SANS Chicago 2013
Washington, DCUS
Oct 28, 2013 - Nov 02, 2013 Live Event MGT415 at (ISC)2 SecureSoCal 2013
Chicago, ILUS
Manhattan Beach, CAUS Oct 31, 2013 - Oct 31, 2013 Live Event SANS South Florida 2013
Nov 04, 2013 - Nov 09, 2013 Live Event MGT415 at (ISC)2 SecureDallas 2013
Fort Lauderdale, FLUS
Nov 06, 2013 - Nov 06, 2013 Live Event SANS Pen Test Hackfest Training Event and Summit
Dallas, TXUS
Nov 07, 2013 - Nov 14, 2013 Live Event SANS Sydney 2013
Washington, DCUS
Nov 11, 2013 - Nov 23, 2013 Live Event SANS Korea 2013
Sydney, AU
Nov 11, 2013 - Nov 23, 2013 Live Event Cloud Security @ CLOUD Expo Asia
Seoul, KR
Nov 13, 2013 - Nov 15, 2013 Live Event SANS London 2013
Singapore, SG
Nov 16, 2013 - Nov 25, 2013 Live Event SANS San Diego 2013
London, GB
Nov 18, 2013 - Nov 23, 2013 Live Event FOR585 Adv Mobile Device Forensics
San Diego, CAUS
Nov 18, 2013 - Nov 23, 2013 Live Event SANS Thailand 2013
Vienna, VAUS
Aug 26, 2013 - Aug 31, 2013 Live Event SANS OnDemand
OnlineTH
Books & MP3s OnlyUS
Anytime
Self Paced