Collin Sampson: Collin Sampson Edited MC

Sean Martin: Let's record there Surname name again, Collin? Uh, Sampson Sampson, that's right. Yeah. All right Here we go. Look, look natural. There you go. All right.

Collin Sampson: of the, 'cause one of the cases that I identified during the session was in an HR system where a system administrator was logging in and writing down personal information of the employees. He wasn't... So none of our fancy technology would've, would've caught him. Right. You know, trying to s- Paper and pen. Paper and pen. And you think in terms of we all go to meetings with a notepad or, or you're taking it on your iPad or your phone or whatever it is and, and where's that data going,

Sean Martin: Collin Sampson, how are you? I'm doing well, thank you. And you? Very good, thanks. Uh, it's a great place to be. Yeah. Denver, Colorado. Yeah, the weather is great. It's great. I'm enjoying the views. I know. A little, it was a little crisp when I arrived yesterday. Yeah, yeah. And, uh, great, uh, yeah, great skies, right? Yeah. You can't beat it. Great skies. This is my second time in d- in, I guess, the Denver area. Okay. So this is, this is good. Yeah. And we're out, out, uh, in the outskirts by the airport. Yeah. I can see the airport- So not, not a lot of fun stuff to do, uh, locally, but we're here for the congress anyway. Exactly, and it's probably a good venue. No one can escape, right? That's right. No one can run off into town and hang out and miss the conference. Exactly. You have everything right here. Everything's here. If anybody's been to a Gaylord property, they know. And it's a great venue, too, so they- It is a great venue whoever picked it, they made the wise choice. That's right. Yeah. That's right. And, uh, clearly they made another wise choice. Thank you. They had you, uh, present a program that, uh, that you put together, and, and, uh, we're gonna talk a little bit about that. Um, clearly, well, maybe not, ISC2 Security Congress, uh, is where we're, we're at, the Security Congress here in, uh, in Denver. And I'm talking to keynotes and speakers and presenters, and I'm, I'm thrilled to have you on, Collin. Well, thank you. So maybe, um, a few words about what you're up to, uh, and then we'll talk about the, the session. Yeah, no, and I appreciate it. So, you know, I've always been interested in presenting. It's public speaking.

Collin Sampson: And I, I've presented two times before at a couple of ISC2 events, and so I [00:02:00] was anxious to come back or looking forward to come back again. So I, I made the proposals in terms of, you know, you have to propose things to come and present. And I thought of what would people wanna hear, and I thought of things that I deal with a lot in the security space. And one of the things I thought of was, well, let's talk about insider threats. So I started looking back on my experiences dealing with some of the cases that I've worked on or s- things I read about, and I thought, let me bring this to a larger audience. So it sort of like f- made me revisit some of the things that I dealt with, so I thought it was a good topic, and it got selected, which I'm very thankful for, the people who go through the selection process to get selected. So, no, it was a good event this morning, so I really enjoyed it. And it, it's interesting because, well, maybe you'll, you'll break my, uh, my assumption here that it's not AI, but, uh- ... a real human, right? Exactly. A real human, uh, topic. Um, what was the catalyst for you to pick that topic? 'Cause I, I don't know, I think a lot of people think, yeah, insider threats- we have some things in place, not really top of mind. It's whatever the board's asking about. Yeah. It's whatever's in the news. It's very, not typically insider threat, right? Yeah. I think one of the reasons I was picking it, a couple of things, it's like looking at a lot of these conferences, everything is so AI focused, which is good, but to your point earlier, this was very good in terms of one of the reasons why I picked it is very people-centric. And when an insider threat is realized, the impact is so great. Mm. It is so significant because it's an, it's a trusted individual or individuals that are doing something. And sometimes it's intentional- Right ... or sometimes not intentional. It could just be maybe I just need to work on this thing, so I'm gonna email it to myself and work at it at home, or I'm gonna have, like, a really sensitive or privileged conversation in the hallway of- at the airport. You know? I, I don't mean anything by it- Right ... or it's not intentional, but someone's eavesdropping and they pick up that information. Yeah. I'm gonna work on my annual fiscal, uh- Exactly ... reporting on the plane. Exactly. It's not, it's not intentional, but I don't ... On a lot of cases that I've worked on, some of it wasn't intentional. The f- Mm. Granted, they're malicious actors, obviously, but for a lot of times it's people just trying to get their work done. Mm. But it's causing a lot of problems, and it's sort of like, as a security officer, security manager, s- working security is one of the things you have to deal with, and it sort of, like, um, gets you away from the keyboard and all the tools. Mm. 'Cause you actually have to know people. You actually have to know how your company, your company operates. Like, like, how ... Like, i- is it okay for Bob to be in the data center at, at, at, you know, at noon on a Saturday? Right. You know, maybe Bob is doing a deployment and something has to be done, but you don't know. But if you knew what Bob does for a living or how Bob works, then it's not a threat. You know, you know, Jim being in the data center at noon on a Saturday, that's a problem. Mm. Right? But it's sort of like it's knowing your audience, I thought. It's very beneficial and one of the things that we need to keep, keep track of, especially when we're dealing with third parties, too. Right. Right. And it gets into ... And people are people, right? Yep. We're, we're consistent until we're not. Yes. Yeah. Not like technology. Look, technology can have some things too, but I guess the point is- Probably in my, maybe you can correct me again I think it's probably easier to put a policy around some technology. Yes. It's a lot easier, yeah. And it can kind of operate within those boundaries. Humans- Not so much ... do things differently. They get, they change roles. Exactly. Uh, they get asked to do something that's out of scope, if you will. Um, so how, how far back did you go, do you think you have to go, to kind of get a picture of what's going on in the organization to then say- Oh, yeah "This is, this is the threat." That's a good question. "And manage to..." That's a good question. One of the things I mentioned during my session was it's, uh, uh, to the audience there, sort of some of the takeaways I was trying to build a program, it's don't look at everything. Okay. Depending on the size of your... You can't. But if you were to identify one or two key systems or key data points, and then start looking at that. Let's say if it were s- let's say it's an HR system, 'cause that's where all in a company, that's where all of our personal information is. Our and our family's personal information, right? So it's not just me, it's my wife, it's my kids, all of our medical records. Everything is there sitting in some HR. It might be hosted within the company or some third party, but if you were to take a look at that, and maybe you start there or maybe there's a financial system or some system where you're dealing with financial data or patient data, whatever it is, but just look at one thing. Then you start asking yourself, "Who should have access to it?" Hmm. And, or, "What type of access should there be?" And then you sort of go from there, and then you ask yourself, the next thing you ask, "Can I, how do I detect when something goes wrong?" Or, "What's an indicator of something going wrong?" Hmm. Or something being unusual. Right. 'Cause one of the, 'cause one of the cases that I identified during the session was in an HR system where a system administrator was logging in and writing down personal information of the employees. He wasn't... So none of our fancy technology would've, would've caught him. Right. You know, trying to s- Paper and pen. Paper and pen. And you think in terms of we all go to meetings with a notepad or, or you're taking it on your iPad or your phone or whatever it is and, and where's that data going, right? I'm, I'm writing, I'm taking notes during my meeting. It's, it's, and I'm putting it in my bag, hopping to my car or whatever. But you think of all the sensitive information might be in your notepad. Right. This one gets their hands on it or if this gentleman was just writing down a couple of names of people and their Social Security numbers or their family's information You think of the treasure trove that is. Mm. And our tools don't detect that. But if you know that this, this individual, like no one should be accessing the HR system but HR, only during this time of days, you know, so, so you sort of like build some of that intelligence into trying to detect it. It's not foolproof- Right ... but it goes a long way as far as in terms of like knowing your audience and knowing your employees.

Sean Martin: So d- are you looking for like adjacent signals in, that- I mean, what, how, how do you recognize the, the pen on paper? Or is it just, uh, the obvious is they're not in HR, they're in the HR system. It, it, the- But if they are supposed to be- Yeah, it's sort of like, um, and it's that- And they're selling that information.

Collin Sampson: It's that particular case. We didn't know about it until law enforcement contacted us, you know, so that was- Okay ... that was a very difficult one- That's- ... and I'm, there's not like a silver bullet in terms of how to catch something like that. But in terms of, is more along the lines of when should that person be accessing- Yeah that type of information. You know, in that case, it's a system administrator be logging in on that HR system- Hm ... on a weekend or after- Right ... hours. You know, only person that may need to be able to do that might be someone with a HR function. Right. But should, IT guy should not be in there unless, you know, there's an issue- Mm that was reported by, let's say, the HR manager or someone in HR or something like that. It- Right ... it's tricky. It's not, it's not easy. Right. So I'm wondering, and it, it starts to lean to how much do you look at, but I mean, if you're logging every, every access- Yep ... and showing that somebody's looking at this executive, that executive, that executive, maybe somebody else on the team could say, "Why-" Why? Like, why is Bob, why is Bob gonna- Why, why is, why is that happening? Yeah. And, you know, and I think- Because- ... and there's so much data in terms of logs, right? People logging in. Right. You have the legitimate users logging in. That's everyone in HR. You have a large HR team, 10, 15 people. Yeah. They're logging in 'cause it's their job, right? It's their job to look up what my medical benefits are or to, especially during open enrollment, right? So, but it's the, the unusual cases, and I think that's where AI can help us a lot as far as, as, you know, filtering through all that, that you could build a profile. Right. And so you could say, "Just alert me when something un- unusual happens." Mm. So AI can ingest all that data and let you know, well, okay, these are the ano- There might be false positives there, but at least you have a smaller sample set than, than, than the world. Right. So it might, it might, it might filter out maybe 10 people or 10 access per over a particular day, and then the security person or the HR manager, "Okay, I just need to look at these," as opposed to looking at- Yeah you know, the thousand times my HR team logged in today. Right. You know, so it's, you know, the, you know, in, in finance, they do it a lot in terms of, uh, trading applications, banking applications, retail applications, this whole concept of anomaly detection and behavior biometrics, like how do people interact with systems- Mm

Sean Martin: and things like that. I think that that type of technology or this use case needs to shift down to the, to the rest of, the rest of the world. Yeah. Yeah, and the, the desire to actually do something about it. And I guess, so clearly [00:11:00] one trigger, law enforcement shows up you do something about it. Um, what are some other things that get attention of- Yeah, I think-

Collin Sampson: the people in the organization that says, "We should be-" We should pay caution ... "taking a little closer attention here." Yeah, some of the cases I worked on, it's where employees reported it. Okay. A lot of times, it's, it's an employee noticing someone. They're noticing ... A lot of times it's ... A lot of the training that we had to go through after some of these things happened was about recognizing change in behavior. Mm-hmm. You know, someone is usually very happy or whatever, then all of a sudden they start being very disgruntled, or someone is always complaining about work, you know? Or, "I'm gonna quit, I'm gonna quit." You know, "I'm gonna show these people," what- whatever it is, right? People go through these things, so you'd have to start, start pay- paying attention. But in a lot of cases is the best detection I've found is an employee reporting it. Hmm. Or a supervisor recognizing unusual behavior or noticing a change in the, the tone or the attitude or the personality of the employee and saying, "Hey, could you, could you guys, like, up the monitoring on this person? Like, take a look at this person's access over the last, you know, month or s- ... I, I ... Like, how long have you noticed it? "Well, I noticed a change in behavior for about a month or two." Okay. Let's look back- Hmm ... at this person's access, and then you might start seeing ... It could be maybe there's some problems at home or whatever that's not related to work. But it's, a lot of times the triggers come from fellow employees or the managers- Hmm ... or the supervisors 'cause they're living and working with that person every day. Because it's ... A lot of times the tools don't, you know- Right ... 'cause it's, because if you ... At the end of the day, that person's authorized to access that system. If I'm a system administrator, I'm a finance manager, I work in, uh, HR or wherever, or marketing, wherever it is, I'm authorized to see that, to see whatever it is. What you're looking for is am I doing something with it I shouldn't? Or am I trying to get to it at a different time? I'm printing it out or whatever the use case is.

Or I'm, I'm discussing it with the, I'm discussing the quarterly financial report with someone in the marketing department. Hmm. You know? And then it's up for that marketing person to say, "Hey, you know, I was talking to Bob and he was telling me all this stuff about our Q1 financials, and, you know, I shouldn't know about it." But it's, but that, that's, that's how it helps. Right. How much of it is, um- A cultural thing versus a tech thing I think it's, uh, culture goes a l- a big part of it because it's ... You have to have that, that kind of environment where people know that they could report things and not be penalized for reporting things. Like, I've worked at companies where, like, our manager would say, "Tell me everything first so I could sanitize it before it going any further." Right? So y- 'cause, like, he was concerned that it would, it would reflect badly on him if an incident- Mm ... was discovered in his world. Right? So that, that's the bad way. Right. So that happened a lot, and then the company had to revisit it and launch brand-new training to say anyone could report anything at any time to compliance and security. You don't have ... There's no check with me first. Like, if you see something, suspect something, you could report it to, to anyone. You could report it to, like, anyone in the security team, compliance team, legal team, HR. You need to check with your manager first, but it's ... I've worked in environments where we had to check with a manager before, but I think it's having that culture to say, "We trust you. We, we have an open environment. You see something suspicious, you see something unusual, report it." Because it's not just from an insider threat standpoint. We want people to have that attitude when it comes to reporting unusual things on their computers. Like, we tell them it's, you know, the, the malware detection is not gonna detect everything. It might just detect signatures, but if you're noticing something unusual with your, your laptop is taking- Mm forever to, to boot up today, you see strange things in your email. Like, you, you don't sit on it. Or you get a strange, you get a strange phone call, don't sit on it. Tell somebody. Right. So the same thing should be applied to insider threats also. You're noticing, "Hey, this is, this is, you know, like, I work on the third floor, and Bob from the, from marketing is down here. Fran, he sits on the seventh floor, but he's sitting in a cubicle next to me. Like, why is he here?" Right. You know, those are things that, that have to get reported, and- Mm ... the people are holding the door for some- You know, like, all these different things. It sort of goes a little bit against your nature a little bit- Right 'cause we, we're forced to ... We, we're conditioned to trust. Right. You know, we also don't wanna be the snitch or the squeal and all these other things, but- And sometimes we're busy Doing our own thing and- Exactly. Exactly. I think it's- Held, held to our own, uh, KPIs. Yeah. It's sort of like, um, I think it's getting people to recognize how valuable the data is or what they're working with. You know, one of the things I always say when I'm doing training classes or awareness classes, I'll tell people it's, you wanna exercise the same level of care as the, you know, you want the people at w- that you're doing business with, that has access to your data, that they're exercising the same level of care. Like your credit card company, your insurance company, you want the people at your medical insurance company to be taking excellent care of your data and of your family's data, right? Mm-hmm. So you should do the same thing for whatever it is you have access to, right? 'Cause it's sort of like I, I do my job well, and I hope, 'cause I want the person working at m- at my medical insurance company, that they're just not leaving my, my file on a printer or in a fax machine somewhere, you know, with my, all my Social Security number, my family's Social Security number.

Sean Martin: I want them to take care of it, and I should recognize and I should wanna be able to do the same thing for- Mm ... the data and the systems or whatever that I'm entrusted to safeguard. Yep. I was talking to, uh, well, a few people. Uh, Scott, uh, Beale, new CEO. [00:17:00] Mm-hmm. Casey Marks, who runs, looks after all the exams and certifications. Yep, yep. And then also, uh, just, uh, the gentleman Joseph Carson and kind of this idea that, that we need to have these stories- Yep, yep ... to kind of evangelize what we're doing and why it works. Yeah. Not just from a security vendor perspective, but I also think from a, a business and operational perspective like you're doing. Yeah. Um, to help your peers say, "I've seen this. I have questions about that. How do you deal with it? How do others deal with it?" Exactly. So I'm glad that you took the opportunity to, to share that story and present it here. What was some of the, some of the feedback from the audience? And did you get folks coming up to you and- Yeah, I think a lot of the questions were

Collin Sampson: One of the things I, I challenged the audience with is, as I was presenting, I said ... 'Cause I, I exam- I, I [00:18:00] explained, like, how we handled it at the time. One of the things I challenged them with is how would you have done it differently? Hmm. ' Cause at the time we were dealing with that incident or that issue, we had limited information. You're trying to get it resolved as quickly as possible. Well, you know, but, you know, 20/20 hindsight, you'd have done it differently. So one of the things I asked them is, "How would you have done that, handled that differently with y- now you have more information?" So a lot of folks came up to me afterwards asking, you know, "Well, I would've done this differently. Maybe I would've spoken to the employee or have ga- gathered more information." ' Cause a lot of times you just need to shut everything down or- Right ... 'cause you don't want it to be worse. But it's, but those are a lot of the questions, and some of the questions were in terms of some of the things that you asked are how, how would you detect it? How, how would you know is this an anomaly versus- Hmm ... unusual, or, you know, unusual versus regular behavior? And a lot of times it's you just gotta know the company that you're in and what's, what someone's supposed to be doing versus what they're not. And you're gonna make some mistakes there, but you just have to exercise caution that you're, that you're making the right decision. And what I mentioned is have someone else look at it. Hmm. Like, if you say like, well, okay, I s- I'm picking on Bob here. But if you, like, if you suspect Bob is, like, doing something nefarious, have someone else look at the data you collected. You know, don't, don't just base it on like, "Oh, I'm the expert. I know everything about this thing" or whatever. Yeah. Have someone else take a look, have the second set of eyes on it because it's, in a lot of these things, is ... I'm gonna also mention during the, the session when someone asked is, I mentioned it's you have to be very careful, very judicious, because if you accuse someone and you're wrong- Mm ... there could be legal action. On the same, if you accuse someone and you're right, there could be legal action. Right. Right? 'Cause you're gonna have to prove everything, and you, you just gotta make sure that you're ... Insider threats, in my opinion, or I guess not just my opinion, general, it's, it's not just a security thing. I think security might just be there for implementing like whatever controls or behavioral things, but a lot of it is from HR. Right. Legal. Then legal. Legal, legal will design the whatever punitive measures, but it's, usually it's HR is the one that comes up with the training because it's so people-centric to say, "How do I recognize a change in behavior in someone?" So that's like the coach you want that as a supervisor to say, you know, "This person usually comes in at, at 9:00, but now they're coming in at 8:00 for no reason. Or they usually leave at 5:00, but now they're leaving at 6:00." Right. You know, like, like all these different like what's changed, and for you to a- have that conversation without being in an accusatory way. Yeah. But tha- those are some of the, the questions that came up in terms of- Okay ... like how do you detect, how do you manage, how do you resolve, how do you get a more in terms of how do you get other teams How do, how do I collaborate with HR- Right ... or legal or compli- whoever it is, that I'm just not sitting in a box trying to do all this stuff myself. Right. Yeah, 'cause I, I was thinking the same thing, all the, uh, the, the multidisciplinary or multiple roles and, and functions across the organization that you have to interact with.

Sean Martin: And I'm wondering how you take that and how insider threat in particular kind of slots in with the rest of your- Yeah ... security program, um- Mm ... in terms of how you Yeah. Does it, do you connect it to fraud? Do you connect it to- ... to your risk management? Do you connect it to security operation? And kind of what's that picture look like?

Collin Sampson: I think it's, it's, it's part of it, I think it's intrinsically part of everything because it's, as you're, when something bad happens and you're investigating it and you figure out, okay, this didn't come from outside. Okay, this was an employee. Mm. And so you sort of like have to get different people involved now. Or sometimes you get a report that, "Hey, s- we saw this file that's been on the internet," and you, and see, then you start looking to see, like, who did it or where did it come from. But, you know, it's, and once you figure out it's an employee, or you, you might get a report from HR or a supervisor, so you already know it's an employee. You know, you know, so 'cause there are times where like, uh, like IT support are on the person's l- computer doing some kind of remote work and they notice something weird. Mm. You know? Like, they, they see some files open that shouldn't be or they, or they invest- while investigating some other incident, they notice emails going out about something else. So once you notice it's an employee, then it's very different because you have to, now you have to get HR involved. Hmm. 'Cause if you're dealing with a bad actor on the outside, HR is not necessarily involved there, right? So there's like, there might be legal consequences and all that stuff depending on what the type of attack it was, but once you've figured out or you think it's an employee, it's, like, the whole conversation changes. Employee, contractor- I was gonna ask if it changes based on the- Yeah, it, it- ... the level of, uh, engagement. It, it, it, you sort of like have to, 'cause now HR's involved- Hmm ... 'cause now they have to, whatever disciplinary action thing is gonna be involved. They, they start worrying about lawsuits and making sure that e- they have to make sure that everything investigat- investigatively is done just to make sure- Hmm that, 'cause nobody wants to get sued. And they would, they, HR starts, which reasonably so, right? In terms of whether or not they're gonna get sued or they're gonna be accused of bias or whatever it is. So once you've made a determination that an employee or a contractor is involved, you have to get HR. Mm. Bring HR in, and then ... And usually my job there is collect whatever evidence there is. Like, I don't get involved in any kind of disciplinary action. That's not my call. Right. Any kind of punitive measures against the employee, that's ... I just collect the evidence, or people on my team would collect the evidence and hand it over to HR, and, and I'm out of it. Right. You know, I document whatever I need to document. I give everything to, to, to HR, and they take care of it from there. If they need follow-up, you know, then, then I give them whatever follow. But I stay out any conversation in terms of, you know, should we terminate, should we suspend? That's, that's, that's the, that's, that's not my- Somebody else that's, that's, that's an HR and legal thing to, to deal with. But yeah, it's, it's very interesting dealing with that. But, but it is part of the ... Because any kind of, um, ins- issue or incident within the organization that inter- can be an insider. Right. Almost anything, right? So- Yeah ... and whenever it does- Intentionally or not.

Sean Martin: And, um, maybe we'll, I'll close with this. I mean, if, if there's something else you want to add, of course you can. Um, but I'm wondering Do you, should you, shouldn't you treat the security team differently from an insider threat perspective? That's interesting. Well, you're sort of like the, the fox guarding the henhouse.

Collin Sampson: Right. Right? So yeah, it's ... Oh, that's a [00:25:00] tough one to answer. Right. But, but, but you are right. I think everyone, you know, my, my boss, I had a boss used to say like, "No one is above approach, and everyone's replaceable." So it's sort of like it's ... I would say if I were to suspect someone on my team was doing something, then I would, then I would, I would ask out of it. Right. I would ask out of the investigation, the analysis, and have someone else do it. But I think it's everyone has to be monitored. Right. I think that's why you look for the, you know, separation of duties, right? The person looking at the logs or looking at the things is not the person managing it. So that's, you sort of like have to have that separation of duties so that if We used to have this thing in terms of, um, people reporting incidents or reporting suspicious activity, and it was whistleblower- Right ... type things. And it's sort of like, who gets it? Who gets the message? Yeah. Like if, if an employee goes to the incident reporting or issue reporting button on their computer or on a phone call, who gets that message? Mm. And it's always a political nightmare- Right. ... to figure out who gets it. And one of the things that we've always fallen back on, it should go to at least three people from three different departments. Mm. Right? It should, it, like it should not- Right ... you know, it should go to like, let's say for ex- it should go to legal, HR, security. Legal, HR, compliance. Depending on how- Right ... your organization's made up, but three people under three different reporting structures. Okay. Right? So, so if it's about... So let's for ex- like the- So it can't get hidden, can't get manipulated. Exactly. Should I be making a complaint about HR to HR? Right. 'Cause let's say I have a, let, let... Or should... Let's say I have a issue with an HR analyst. Should I really be sending that, that complaint to the HR manager? 'Cause then H- the HR m- might bury it. Or like the example I gave earlier, where like e- where the manager wanted everything to come to him first. Right. So we've sort of like landed on this three, like a triumvirate kinda deal. Like it gets reported to that group, and then a copy of it goes up to like the CEO or the COO or some, some other person gets the reports. Right. Someone else sees it, and, and then you sort of like need to like follow up on it. Like, "Hey, what's..." So when they meet quarterly or whenever they meet, like the COO or whoever it is is supposed to ask, "Hey, what happened to this?" Like, "How many incident reports did we get this month? And okay, what's the status of this?" And then it's up to like that team of three to say, "Oh, we investigated it." 'Cause if it was anything real, you would think it would, it would have made it to the COO. Right. Right? 'Cause we had to terminate someone, false positive. Like whatever the disposition of it should have at least reached the C- You should have it documented, right? So then... But yeah, so that, that was a thing we had to do because people were worried, like what if it's an H- what if I'm complaining about legal? Or what if they're complaining about the security team? Right. You know? And then it's sort of like, well, I shouldn't get it. Or maybe I should see it, but I shouldn't be investigating it. Right. Or maybe I shouldn't even see it, you know? So it's sort of like a, there's, there's a lot of, um, incident reporting tools, like some of the commercial ones, like you, you select a category. So you could build that logic in. So if I select I'm reporting an incident and it's about security, then it wouldn't come to me. It would just go to the other two people. On the, you know, like- Right ... if I have that triumph, it will go to legal and HR. And if I'm reporting something about HR, it's gonna go to, like, legal and me. Right. Legal and security. So, so you could build out logic, and there's a lot of commercial tools out there. One bank I worked at, we deployed a tool like that. So depending on the category that the person selected, that they're complaining about, or the product, or whatever it is, maybe they were mistreated by a vendor, or they're, they saw something with the, when they interacted with someone in the, you know, the marketing department or whatever. But depending on what they selected, you can make sure that the person who is the target of the accusation doesn't get the notification And that's ... And if you're a large enough company, you could definitely ... That would be the thing you'd wanna do. Right. And sometimes in a small company you could do something like that. Everybody knows anyway. Yeah. When you said the three people, I'm like, three people, different reporting structures, that's the way to do it. Yeah. You have, you have like a little triumvirate that no one can bury it. Or- Yeah ... in order to bury, there's collusion. And now, now you got a bigger problem. Right. Right? So if there's collusions, find out there's collusion, you know, probably everybody's getting fired, right? Yeah. They're, they're gonna fire everyone, right? The COO, the CEO. 'Cause ... E- especially if it turns out to be big, right? Yeah. The coverup is usually worse than the actual, uh- True ... right? So. Yeah. But yeah, we've worked a ton of those things. It'd be a TV show. Yeah. We've worked on a ton of those things where people are like ... But yeah, once you figure out is the, um, what ... It's usually the, um, the employee reporting something. Hm. You know? And you, and you wanna have that culture, not just from insider threats, but you know, someone mistreating someone else. You know, like harassment, like all- Right ... these different things. You want people ... And you know, we all go through, every company goes through harassment training every single year, right? So we wanna have that culture where people feel free and open to report those things- Hm ... and not have to worry about retaliation or anything like that. Same thing if like, if I suspect, you know, you know, Bob is like misusing his computer or sharing his computer with, with his family, or sending files over to a, to a competitor. Or, or I was in a call with Bob and we were talking to, to a client and Bob disclosed like the pricing that he wasn't supposed to disclose. Hm. You know, like all these ... Or he's cut a deal for, you know, like this thing for, for, but not for another client. Or like all those things, they seem minor, but they point to a larger case. A lot of times we get a call to say, "Hey, show me all the emails that Bob sent during the last month." Hm. That because someone suspects something. Right. You know? And we'll, sometimes we'll get that from HR. Like, "Show me all the emails that someone sent during the last month." And, and sometimes I'll, I don't ask why. 'Cause I don't wanna know. You don't wanna know. I don't wanna- The less I know, the better. The less I know, the better. 'Cause I'm like, you know, HR is authorized to make that request to me.

Sean Martin: Mm-hmm. Right? I'm like, "All right." Yeah. I remember back in the day, uh, building endpoint security software, one of the things it would analyze the different types of files- Yeah ... to- So if somebody had information that they shouldn't Yep, yep ... uh, legal content. Isn't it? Pirated software, pirated- Oh, yeah, yeah, yeah

Collin Sampson: movies. Movies that shouldn't be, that nobody should have. You know what I'm saying? Um, another, it's, it's an insider threat- Exactly ... not necessarily an attack. Well, yeah. It's, it's- But it's stuff that shouldn't- It could cause you a lot of money if it's realized, right? Exactly. Yeah. I know one company I worked [00:32:00] at, the guys in the, um, in the storage team, they had every movie that you, that you ever, that you ever wanted. Yeah, pirated movies? Pirated movie? Yeah. And they, and they'd move it around. They'd move it around the storage system so no one could find. But if you needed it for a weekend or whatever, like, uh, all the hot releases, they had. There you go. They'd have, they had it sitting on the file. Every piece of software, every movie, they had a living on the file servers. Mm-hmm. And they would just move it around in case anyone came looking. But those who knew, knew where it was- ... and knew to download it or how to get- Yeah ... they'll cut, they'll burn you a CD or a DVD or whatever it was to, like, get- Crazy ... get the stuff. But yeah, they had every, every movie you ever wanted. But, but to your point, if someone were to find out about that, right? Yeah. So then it's, um, then, then we'd all get in trouble. Yeah. Some, some kind of action you don't want, I'm sure. Yeah. But you know, insider threats, it's sort of like, it's- Ah ... it's one of the things that we all deal with, right? Right. In terms of, like, in the security space, it's, there's always someone doing something that they shouldn't do or they think it's no big deal. Because- Yeah ... it might be malicious or I didn't get the promotion So I'm gonna, I'm gonna make you suffer for it, or you promoted Bob instead of me- Hmm ... so I'm gonna show you how, I'm gonna show you how stupid Bob is by, you know, breaking what he did, you know? So it's sort of like, or my boss doesn't know what he's talking about. I'm gonna show you. You know, kinda- Right ... like this whole retaliation kinda deal, but it's- Hmm ... or it could be, like, financial, or I'm just gonna steal this so I could go sell it outside and- Exactly ... or I'm being co- coerced in some way, but it's sort of like, yeah. So if my co-founder Marco was here, he would say, "You're done."

Sean Martin: And I always tell him that I have one more question. And it's, it's a, this is gonna be a can of worms, but I'm gonna do it anyway. And you can share as much as little as you'd like. Um, when the insider is one or more agents acting on our behalf, [00:34:00] AI agents. Oh. Any, any thoughts on that? That is an interesting one 'cause it, just listening to some of the sessions- Hmm

Collin Sampson: today and just w- w- watching a lot of webinars and things like that, it's ... I think that the practice is the same, except there's obviously no legal or HR action 'cause you're not dealing with an individual, but the investigation- Hmm ... is still the same 'cause you have to treat that agent, you know, this like anomalous- As a source, yeah blob a- as the attacker in this case. And you sort of have to go through the same, like what does it have access to. Mm-hmm. And you've got ... And then probably now you need to go to the person who created the agent, like what was the intention of this agent? And some of the sessions I went to this morning mentioned that, you know, some of the agents, like, you know, have a mind of their own a little bit, like they go off. So then it, so then you ... So maybe it's a training issue. So may- so maybe in that case it's not a malicious or intentional. Right. It's unintentional because we didn't code the agent correctly. We didn't- Hmm ... put the prompts in, but the investigation is still the same except it's maybe the, from an HR side, it's not necessarily there. And once you, once you've determined that the person or persons who wrote the agent or created the agent, maybe they didn't code it correctly or put the correct parameters or guardrails around it. Yeah. But it's, but your investigation's essentially the same. You're just not, you know, walking someone out the door. Right? You know. Or maybe you are. Maybe you are. 'Cause I can, because maybe after investigating- Yeah ... you know, smarter people than me who are doing the investigating- Hmm ... from a personal side of it could determine, hey, you know, what was your motivation from this? Hmm. Well, you know, on the person's, for what I wanted to screw you guys over. I wanted to get this data out because I'm gonna sell it to my, to your competitor. Right. Or I'm upset because you didn't promote me last week. Right. Right? So it's, once you get that motivation, then maybe it changes, but once you detected it, you, I think your investigation just follows- Yeah ... your, your standard instant response and, but then your punitive actions may be a little different or nuanced.

Collin Sampson: Ah, I can say I could talk to you for hours. There's so many scenarios. I'm, I'm just thinking the new shoes are gonna come out. I know how the, how the system works, where stuff's going. I can write some things and get, get the scoop on the shoes for coming out or tickets or- Yeah, yeah. It's, it's, it's fascinating how- Endless

Collin Sampson: it's fascinating how- Yeah ... like, you know, like launches and like people who- Yeah, where famous people are gonna be. Yeah. That happens a lot, right? You always wonder who these sources are, right? Mm-hmm. Or like, you know, when Nike is dropping a, a new sneaker or whatever, it always gets released or... But those are, those are guarded secrets, right? Yeah. I'm launching a product, you know, I'm launching the 2.0 version of my product. I don't want anyone to know about it, but if I let the competitor know- Right ... and I share some information because, you know, maybe that individual are like, "Well, I don't really like my..." They don't like their position at the company, but if, if they release it to the next company... You know, that, and that's why I think insider threats or an insider, it's like it's so personal- Mm ... when you're victimized that way. It's like you feel betrayed. I know one company I worked at, we had a... It, it wasn't let's say, like, the... We had an employee to spam the entire company. Just like sending like- We used to do that for fun back in the day. Just sending emails. You can get to anything, just fill your inbox with junk, right? Right. So it wasn't necessarily malicious. It was just like a productivity hit that we had to deal with. I remember our CEO at the time, and we were dealing with a lot of other security issues at the time, but the thing that, like, that pained him the most- Mm was that particular incident because he's like- It's personal ... 'cause it's like, how could he do this? Right. It's like he has the access. Mm. He's trusted. He's trusted to do whatever d- whatever his job was, but to go to do this just to hurt us- E- like, it was like, it was like, you, you become so vulnerable. Like, you're- Mm ... you're okay with, uh, okay, I could deal with, you know, some bad guy or whatever, attacker, hacker, nebulous, you know, black hat hacker or whatever it is trying to break in. But it's like you've gone through, you know, the background checks. Mm. You've shared meals with the people, like all this stuff, and you're just like- Right you just feel pained when it happens. Mm. Like, there's never ... So he was just so pained by it. There's just so like ... And then, then you overreact. Well, let's look at everyone. Let's, like, shut everything down. And I don't trust anyone, you know? So it seems like- Everybody gets punished together- ... 'cause of the one bad apple. The one bad apple. Yeah. But yeah, no, but I think insider threats, it's something we all have to deal with, and it's just sort of like it's being able to recognize, recognizing the folks- Mm ... in your organization, knowing what's anomalous. And, but I think there's a lot of doom and gloom about AI, but I think this is where- Mm AI can really help in terms of being able to sift through all that data, looking through it, and letting me know, as a security professional, what's the unusual. Right. This is unusual. This is interesting. Yeah. Yeah. I, I sort of narrowed, it narrows down the things- Mm ... that I gotta take a look at. Right. Yeah.

Sean Martin: So I think. Super cool. Good world. Collin. Thank you very much, Sean. Pleasure chatting with you. Thank you very much. Really fun. Uh, hopefully people follow you, and, uh, I'm glad people like you are doing what you're doing. Thank you. Thank you. Let me know when this comes out. Yeah. I'll drop it on my, uh ... Or where I could find it. Yeah. That'd be great. Yep, itspmagazine.com. Be part of all of our coverage of, uh, ISC2- All right ... Security Congress, uh, under the, uh, under the blog. And yeah, lots of good conversations. Cool. So appreciate you. Thanks everybody for watching. Stay tuned. Thank you. All So you're gonna edit it, right? No. No edits. No edits. No edits. Plain. One take. Give me my mic. Thank you. I need my mic. All right. You should do a selfie too. I was gonna run off. You were. I saw that.