The CERT for Safety and Industry (CERTSI) warns of insider threats

The CERT for Safety and Industry (CERTSI) Warns of Insider Threats

Incidents of internal origin (insider) can bring terrible consequences for organizations. In the following article, "Insider, the two faces of the employee", the CERTSI echoes the internal risk (intentional / unintentional) and considers some of the possible causes.

Possible Motivations Behind Insider Threats

• Money: The attacker is motivated by the possibility of obtaining a sum of money for the actions they are going to carry out.
• Revenge: Discontent is usually the greatest motivation. A dismissal in which both parties do not agree, or problems with co-workers, can motivate a former employee to take harmful actions against the company from which they have been dismissed. The former employee does not seek economic gain or to favor other companies — they simply want things to stop going well for the company that fired them.
• Distraction: An internal threat can originate as a distraction to perform other malicious actions and prevent the main objective of the operation from being revealed.
• Ignorance: An employee may leave public services accessible that should not be, or take actions without knowing their consequences.
• Industrial espionage: Actions may be motivated by a competing company to obtain privileged information about processes.
• Others: More origins can be found by contacting Kymatio.

Complete article (Spanish): Insider, las dos caras del empleado

About the CERTSI

The CERT for Security and Industry (CERTSI) is the Capacity to Respond to Incidents of Information Security of the Ministry of Energy, Tourism and Digital Agenda and of the Ministry of the Interior. By agreement of the National Cybersecurity Council of May 29, 2015, CERTSI is the National CERT competent in the prevention, mitigation, and response to cyber incidents in the field of businesses, citizens, and operators of critical infrastructure.

Operated technically by INCIBE and under the coordination of the CNPIC and INCIBE, the CERTSI was established in 2012 through a Collaborative Framework Agreement on Cybersecurity between the Secretary of State for Security and the Secretary of State for Telecommunications and for the Information Society. It is currently regulated by an Agreement of October 21, 2015, signed by both Secretaries of State.

Operators of critical infrastructures — public or private — designated by virtue of the application of Law 8/2011, have in CERTSI their point of reference for the technical resolution of cybersecurity incidents that may affect the provision of essential services, according to the Resolution of September 8, 2015 (published in the BOE of September 18), of the Secretary of State for Security, which approves the new minimum contents of the Operator's Safety Plans and the Plans of Specific Protection.