0:02talk today rethinking insider threat um in a uh agentic and ai world um you know how things have potentially changed um we're going to talk through some of that and go through some scenarios and things here um the cast of characters here photos look very relevant to insider threat if you've all picked up on linkedin anytime recently uh the one photo graph that was tied to approximately, what, 120, 130 profiles? Yeah, I mean, we all fit the bill here, right? But we'll let each one of us kind of go through and introduce ourselves as we get to each one of our sections. We're going to break it up into four different sections, each cover kind of a topic and some things, and then go to Q &A at the end.

0:48So we're going to kick it off with Ryan to start. So Ryan, you want to jump in? Hey, everybody. I'm Ryan LaSalle. I'm the CEO of NISOS. We're a human risk intelligence company. We're a great partner of CloudFlares. They use us to help find some of the insider threats and help prevent employment fraud. So I thought we'd spend a little time today talking about a little bit of those external signals of what we're seeing in the market, of what we need to be ready for. We are going to talk about, to Craig's point, agentic AI. We're also going to talk about how human adversaries are using AI to get jobs inside So the couple stats for you, Gartner feels, they're saying pretty strongly that by 2028, one in four candidates are going to be fake.

1:35If any of you are working with your recruiting teams today, you're seeing that there is an onslaught of bots submitting resumes. There's an onslaught of people going through all kinds of credential inflation. There's diploma mills. These are all the things that have been going on for years and years and years. now with the advent of of deep fakes and nation states industrializing the these attacks it's going to get much much worse i think the uh the second piece in there is that a lot of hiring managers are seeing that 60 of the of the interactions have some sort of ai misrepresentation whether it's inflation on the resume um sometimes assistance in uh skills tests and other things like that but there there seems to be a general inflation of capability of candidates but then more importantly most people feel like they're not ready to counter that and detect it so the notion of if one and four is is fake and we see it pretty prevalently and now we feel like we're not prepared we thought this would be a good conversation to have because we're gonna spend more time talking about the how-tos than the problems and we'll and we'll get and we'll get into that as we go I'm gonna start with a case study, though.

2:48This case study is from a cell that my team encountered last year and run an operation on. You might recognize some of these pictures if you're on TikTok. We are sort of TikTok famous right now. We just hit 11 million views on an NBC News story that was about this operation. But last summer, we had a role open for an AI engineer on our team. We've been doing North Korean employment fraud investigations and publishing about it. since 2023 but one of these guys actually applied for a job with us and we got into the interview over zoom we realized that was going on and we decided to run an operation on him so we reached out to the fbi we went through a set of guardrails and we hired joe that's this guy when uh up at the top left joe the guy on top left has 15 years of full stack development uh experience he's got rag experience from his job at best buy in 2015 a technology that came out when meta released it in 2022 so he is he is ahead of his time and wise behind his years um but we noticed a bunch of things about joe besides the the weird like age discrepancy from his resume his resume all those things in blue exactly matched our job descriptions they are using uh ai to create the personas and create the resumes.

4:15And I'll talk about what tools they're using as we get into it. In the middle, once we hired him, we sent him a laptop. That's what our laptop could see. We ended up inside a laptop farm in Florida. The first red flag we saw from him besides all the weird behaviors was he changed his address right before we needed to send him a laptop. He actually asked us to send it to his mom's house at a different place. When the laptop opened, that was the closet. Cloudflare is an infrastructure company at its heart. And so many of you may be network engineers, and hopefully you're deeply offended by the cabling in this closet. I sure was. But actually, we've blurred out the names to protect the innocent victims, but we can actually see from our camera the names of the other companies in there. There was a healthcare company. There was a mortgage company.

5:02There were a bunch of other companies who were in the closet with us. And the guy who ran the closet was smart enough to know that he he never showed up on camera but they plugged in a kvm switch and they started remoting in and joe logged into our laptop with his personal credentials once he did that the operation really began because we could see all the things he was doing all day long mostly he was applying for jobs and and creating purpose -built resumes and setting them off he was applying to and interviewing for over 70 different jobs a day it was it was like it was pretty crazy But he also logged in to his Google wallet that gave us all of his other credentials. So we followed those into a Discord server where we found the cell he was part of.

5:50So this is an entire network of 22 individuals going back nine months who had applied to 170 ,000 jobs and landed 76 of them. We started pulling down the job offers out of the Discord server and calling companies. and being like, Joe's not a real guy. Michael's not a real guy. And all the personas and try to start to burn them down a little bit. We found four different laptop farms in the U.S. from this. One was part of the NBC story. One was part of Nicole Perleroff's podcast this summer called To Catch a Thief. She actually went and knocked the door and talked to the girl who was running it. That's their leaderboard, the dashboard there. They actually measure everybody and metric them. It runs like a competitive pyramid scheme.

6:36And the guy who's got the top bidder, the top number of applications to jobs is at 27,000 jobs. The top employment, guy who lands the most jobs, landed 19 jobs over the course of this nine-month operation. Now, he didn't do all of them. Some of them he handed off to other folks in his cell. Some of them he went out and outsourced to other job boards to go fulfill the jobs. I thought there was a couple other things that were interesting. One is, that's their shared team calendar. That's all the interviews they had in one week in September last year. Like, it is a whole industry industrialized to get jobs at U.S. companies. That's their only purpose, is to harvest payroll and fund the nuclear regime.

7:21But down at the bottom, they're kind of cheap. They shared one ChatGBT account across all of them. And they were using it, let me go to the next slide. They were using that actually to get through, I don't know, we got, there we go, new here. They were using that account to get through their interviews. So when we were interviewing Joe, he kept looking off screen every time he'd answer He would say, hmm, very interesting. Let me think. And then he would look over here and he would read his answer to us. As we were watching, they actually. got better at they kept getting caught doing that and so they actually increased their technology and they built a teleprompter screen that was a transparent overlay over zoom so they could read their instructions while maintaining eye contact with the camera and it was chat gpt that was powering the answers to their questions technical questions personality questions questions about the university they went to whatever questions you throw at them chat gpt was answering for them and they were spinning it back but like i said they're cheap so they maintain one account across everybody.

8:26And there was actually a budgeting discussion that said that you could only maintain up to $20 a month of spend. So they were starting to stress the system. But also when new models would come out, if they were thinking too hard, it would slow them down in the interviews. And so they would actually have performance conversations around which models to use to allow them to speed through the interviews more naturally. So that was pretty interesting. But they used AI in a lot of different ways. Some of these things are things you can detect when you're as a security partner to HR. Some of the things are a little bit harder, but they use tools to build their personas. To create the resumes, actually, we used a bunch of open models on their laptops, but they use other tools as well to try to gauge whether they look the age of their persona.

9:14We talked about past in the interviews, these face swapping tools. And I think we've seen a lot of people trying to counter that. But as those tools get better. As virtual cameras get better, those are going to be harder and harder to thwart. You're going to have to kind of really train HR to become a deepfake detection capability. And then finally, they actually, once they land the job, they did the job. They were using tools like all of our engineers use to be able to deliver at or above their proficiency level. Most of them were pretty good employees. Most of them got caught because they had to miss meetings because they were. working so many jobs that they couldn't make all the all the facetime stuff but they're all individual contributors they're all working remote jobs and they're all getting better and better at passing for legitimate employees which is a little bit of just setting the table around this the story that we're going to be working through on how do you if if insider threat happens before you even hire the people how do you move earlier left a bang into the into understanding and that were happening how do you build your trusted workforce how do you uh pull all the intelligence that a company has around its candidates and its people to get smarter and smarter about sourcing that stuff and then how do you respond effectively that's what we're going to be going through today

10:34that was awesome ryan you know you reminded me one thing uh last year we had a case we were investigating and when we were talking to the manager of the team he said exactly he goes what that's my best employee I want to clone them like 20 times. And I mean, it's crazy to think these guys are out there doing it just for economic regions, but actually slinging good code. They're not putting implants in. They're not doing anything. They're literally just trying to keep that extra 150K in. I'm Chris O'Rourke. I run the React team as part of Cloudforce One here at Cloudflare. So we do the offensive security, pen testing, red teaming, incident response, and insider threat hunting. I've been doing it for about 20 years, started out of the army, NSA, and I've worked with a lot of the guys here. as well as on our team for almost 20 years. Today, I'm gonna talk a little bit off of that and kind of into this new paradigm that we're starting to see over the past year of it's not just the insider risk or the exterior threat actors, but it's the culmination of AI being leveraged internally once they're in the network.

11:32And more importantly, AI may actually be your insider. I know that sounds kind of weird. Anyone get the next slide? So there's a couple of things that we wanna think about here, right? the access we give our ai is probably the biggest risk we have in the modern world um you know last year everybody was pushing to add as much ai as possible into their environment which was great unfortunately security teams generally were not involved nearly where they should have been um quite frankly because a lot of the practices that you have to put in place to secure the data within your network just hadn't hadn't taken place um but one of the things that we started finding out is that as you're deploying these agents and these entities inside of your organizations a lot of people weren't on understanding what the agent identity was what is the purpose of that agent what is the role of what needs to happen um and they weren't realizing what kind of tools were connected so just like the insiders that were coming in from the outside where we give them a new account we give them passwords you're doing the exact same thing for your ai agents except most of you aren't you're not paying attention you're just giving examples so a good example is a few months ago we had a customer who said hey we added an mcp server to salesforce so that anybody in the can have access via AI.

12:40Who wouldn't like that, right? I'm getting ready to get on a call. I'm gonna query Salesforce and say, hey, give me all the information. That's cool. But if anybody in here has ever paid for a Salesforce license, you know that you're not gonna buy one for every employee inside your organization. So these guys said, hey, we only need one. We got an admin account. So they set the admin account as the account in their MCP server. And after 400 gigs of data were taken and a little post in the dark web offering to sell it, they realized, whoops, we might've had too much. access available so that kind of goes into your biggest gap here right the investigation side when you're deploying the ai how do you detect it how do you detect those behaviors the same tools and techniques we're using to detect people we also have to apply to ai misconfigurations gathering data they shouldn't connecting to you know github at weird hours pulling down the data they're an exact emulation of the actual threat actor that's a human right because we're the ones motivating it um the big thing that we're seeing is is a lack or excessive attempts at identity access management.

13:37So, you know, if you're an economic espionage kind of person, more so than just trying to get a foothold, you're focused on doing your job the right way. You're not pushing security boundaries. But if you're one of those remote workers or you're an insider and you're trying to gather more information out of the company, you're constantly trying to elevate your privileges to get that data you're not supposed to have. There's usually key indicators of this. You see people trying to access systems they shouldn't. You see the alerts and logs. And largely, we pay attention for people, but we're not logging. And when we are, we're not paying attention to the logs of the AI trying to do the same exact thing in our environment. Of course, exposed credentials is a big one. You know, some of the AI hoovering, recently a customer I was working with, they were using Google Drive to share documents. And I mean, we know we're going to tell everyone don't put passwords in a text file, but people still do that and dump it into Google Drive.

14:25Well, unfortunately, they were sending an email to a customer. The customer responded. They had an automated. AI responder. And it decided it was also going to regurgitate a whole bunch of passwords and configuration data that happened to be stored in their drive. Now, I'm not blaming Google for that one. I'm blaming just the structure of how it was set up. But that's a pretty wild one. Imagine, you know, you run a store where you're selling clothing and someone says, hey, I got a medium t-shirt. I needed a large. It's like, cool. Well, just SSH into this box here, gather this data here, and you can have our bank information, right? Like, that'd be pretty cool. I get a large t -shirt and some money. I like it. And then the final thing that we start working about is like, how do you mitigate it? How do you stop those scenarios from happening? Well, you kind of have to build a privileged situation where it's least privileged, just like you would with the people. The same thing when you have an employee who's coming in that you don't know, you kind of put those restrictions on to stop them from accessing.

15:15You do the same thing with your AI agents or your harnesses, whatever you've built, right? You need least privilege. You need approval gates for certain types of actions. If you're doing like CI, CD, where you've integrated the AI components. into it you need to have the right people looking at it just like you would with any other human um and then you just need to model the activity and and what's scary about all of this is that when you take like a remote worker and they're able to come through and use ai to get in they're then able to take your ai and token spend to do their job for you so in many of these instances where you know they were hiring other people to fill the job now they don't even have to do that i mean we're in the age of you know muse and grokbot and everything where it's not infeasible to think that one these scammers will get in, they'll get the job and they're going to set up a bot and it's going to do 80 % efficiency. But you know what? 80 % is probably still 60 % more than the average person when you see the amount of code that's coming out, right?

16:03So you're going to have AI be this next level component of these remote worker scams or even insider scams. I'm not going to say that I don't use AI. I use it quite a bit. I love it. It's everywhere. But you're going to find that there are going to be points where people are going to automate their job and just kind of disappear, you know, and so that insider risk is still going to be there. It's something that, you know, I'd be well aware of in your environment now. If you're not, make sure you understand what the AI has access to. And that leads us into Sharab. Hi, everyone. My name is Sharab Zaman. I help lead our internal cert team, which covers security incidents, covers insider threats, and any investigative function here at Cloudflare. So you guys heard Ryan kind of give the overview from a external intelligence standpoint, like when you're actually tracking campaigns and you're tracking people, what does that look like, right?

16:58And then Chris talking about AI and talking about like, yes, AI is a big risk, right? It's not just the AI itself, it's the humans also using the AI, right? So I'm going to be talking about when these threats start to manifest, now they're hitting you at your front door, what do you do?

17:20uh oh the insider threats took our took our slide over

17:31all right all right perfect so yeah we definitely planned that but i like to tell stories right it's got a bunch of nice pictures up here so we ryan actually mentioned kvms right that is part of tradecraft that many insider threats will use whether it be dprk nigerian so on and so forth because it allows you more access right if you're shipping out a laptop somewhere you would need to access it or someone needs someone else needs to access it but what should an organization do right

18:08as with security learning you do have to fine -tune what you want to detect so in a walkie story of we received an alert it's always three o 'clock in the morning always for some reason right every security issue happens at three o'clock in the morning so we receive a security alert and what's it saying it's saying ip over kvm there are probably legitimate uses uses for kvms but if we were to just run at every signal that fires right we would spend a lot of time just triaging and a lot of toil kind of going through everything so the approach that we take heavy user of ai right but if you're going to identify insider threats in your environment right as a similar to security learning right you want to compound signals together right so in in our scenarios it's like we're looking at okay yes you have ip over kvm alert but what else is happening right we have a home built ueba that will look at variations of access right you will look at anomalies and such and so on and so forth by themselves may be very noisy but together combined with multiple signals it paints a story right so let me walk you through this right you get an ip of a kvm alert while you're looking at it our agents will go and pull some information in richie and say hey user x the same user that they were looking into probably right user x well there's anomalies in access hours

19:35strangely their working hours is aligning with asia I don't know why, right? They're working at night. It's supposed to be in Austin, Texas, but they're working at night. The next thing, for some reason, you see a long duration of Zoom sessions.

19:50Most organizations will use Zoom or some type of messaging platform or a chat platform, whatever, whether it be Teams, Google Meet, Zoom, whatever. But there's something about that, right? Because you can actually give remote control access. So that's another way of allowing other people. access your host or access data that belongs to a particular user and what else well unapproved ai usage right so cloudflare obviously like a lot of our talks today are about ai right the adoption of ai how do you build safe ai so on and so forth so cloudflare does adopt and we own dog food right we have cloudflare os which we adopt internally we have a lot of workflows um a lot of our sort of alerting workflows i was talking workflows or cert workflows or insider workflows are ai assisted we add human in the loop but what ends up happening is that okay you have the sanctioned ai and then you have the unapproved ai right as kind of chris was talking about right like ai can be either your friend or it can be the gateway into leaking a ton of data but the unapproved ones is something that we all must look for right as an organization we should have a common path, you should have a common tool set, a common way of accessing AI so we can control what data goes in there, what data does not go in there, what controls do we need, and so on and so forth.

21:13So if we're tracking anomalies in access, long duration of Zoom sessions, unapproved AI usage, and there's a high number of unapproved software, what's going on? That itself together paints a picture. This person, maybe they're giving remote access. right? Maybe they are allowing other people to access it. Maybe they're developing something and they're using unapproved AI tools because, for example, we have AI Gateway. The prompts that you run in our gateway, we're going to see them. Maybe they know that, or they'd like to do with this, especially if they work it, right? So what this allows us to do, because we can automate a lot of what comes to the forefront, right? We're able to come through a quick determination of, like, is this a potential insider to it? And he's- even more investigation so i'll tell you as we start investigating it we start to realize that yes all of these things are things to look at look into but for some reason people treat ai like it's their best friend right we find a treasure trove of evidence when we're actually whether it's looking through our ai gateway looking at the kind of the prompts that they're doing what kind of work are they doing or even if they didn't use this use unapproved ai you can actually grab the databases generally from computers right and if you was to parse that that's when you start seeing them asking questions is like hey i have access to salesforce i want to send it here right if you use the frontier

22:45models they'll probably say it's not allowed but if you use other models you can likely get through it but we're finding a lot of value in correlating data correlating signals and putting it all together because you need a bigger picture then once you start creating these signals this may not be the only one person right they triggered one alarm but this may not be the only one person we can use that to hunt we can use that to identify a network in our environment we can use that to identify and other individuals not only us right through threat intel sharing we can talk to our counterparts we can talk to law enforcement we can identify okay maybe this is a trend does it impact everyone because honestly a lot of the tradecraft from these advanced apts or the vdprk the nigerians or whatever right they're not targeting just cloudfare they're not just targeting nissos they're not targeting just our customers they're targeting everyone and they are sharing tradecraft so these are signals that we can actually look for oh the number you had it was something like 27 000 with that job applications so that's coming out yeah 170 000 right I mean, going back to it, we have a company we work with that turned off all recruiting because every candidate that made it through the queue was a North Korean fraudster.

24:04And so at some point, it now becomes like a national security issue because people who are trying to get jobs can't get jobs. They've basically hacked, they've DDoSed our recruiting pipelines. And I think the notion of those signals that you're looking for, I love the way you think about it because every step of the way. there's more and more insights you can you can start to mine we'll talk about this at the end but like thin forces decisions and using ai as the synthesis because it's been so hard the false positive rate on insider threat solutions is so high it's so expensive to get the right investigations that more the more things you can start to cobble together through your own lens the the better and more sophisticated and more agile your enterprise response will be

24:49and you know the principles are not new right threat detection whether it's for insider threat or security threats is not new we've been doing it for a few years as an industry actually many years so you apply the same principles maybe the actors change the tactics change right but it does come down into you know the the noise to signal to alert ratio right like how can you get more efficacy and what you want to alert right so that even by us using ai like we're okay why do we do that because we want our teams right there but because we want to have our team be able to act very quickly with information right so you also want the human in the loop but just to kind of take a step back a little real quick right in the in the last scenario i talked about like once the threat actor gets in how do you detect it right what do you do but it doesn't start there right there's a whole story here right It's your controls or what you do to protect yourself actually starts at the inception of the job posting, at the inception of onboarding, at the inception of the applications, right?

25:55So kind of break it down, right? It's pre-onboarding and post-onboarding. But if you think about the sheer number of applicants that you start getting, right, for one job, two jobs, three jobs, it's a lot. but that's also a data source right because we're seeing similar experiences it's different names maybe even similar headshots right many times there's something the same headshot over and over again but changing the name right john smith tim smith whatever whatever name you could think of it's there but what we're seeing is that at that inception of when they're applying right there's a lot of information that you have you can actually correlate resumes you can correlate experience you can correlate even techniques that they use to build their resumes right are they using publicly available tools or are they using software tools to generate the resume you can check to see if the the contents ai generated as well right there's a little bit more deterministic models that are kind of coming out um not fully deterministic but more deterministic you can use that as well but the emphasis here is that at that pre-onboarding stage right you can actually filter and assign risk scores to the applicants that are actually trying to apply to your jobs.

27:13So that's when they're applying. You can look at their resume. You can look at how many, like, you can, so you can create a cryptographic score of a resume and say, hey, this is a unique value of this particular resume. Where does it match up? Everywhere else, right? There's, you can identify similarities there, right? If you have 500 resumes that look exactly, it's almost exactly the same. is different and the phone number is different and sometimes they mess up the same phone number right that's your way to take things out but like obviously you have to work within the confines of laws and so on and so forth right but so that you start there but then then what so insider threat is not just the security folks right it's not just your it people it's not just these guys here that you bring in for help right is the hr people within your organization it is the interviewers right obviously what we don't want like interviews are not going to be the experts of identifying inside threat while they're interviewing them however giving them telltale signs of what things to look out for right it's better to tell us or raise your hand if you see something suspicious rather than assume that no it's fine right we've actually gotten a lot of traction just at that stage where interviewers just saying hey this person very suspicious based on blah blah blah it looks like they're using ai or whatever the case is right but that's that's a training thing that's a cultural thing that you have to build within your organization as well and then as you start kind of moving down the chain right like

28:47you have to validate their experiences if you're if you're at offer stage right that background check is extremely important how many times have you guys seen that like the person applying is dead you right? Or it's like a stolen identity. Like we've had instances where it's a stolen identity and this person has been dead for like 10 years. We're like, wow, where'd he come from? Right? But that's quite important. And then adopting technologies that forces people to verify as well, right? Whether that's through the background check, submitting all your documents on time, submitting your identification cards, and making sure that you actually correlate and identify it, right? Like sometimes, you know, in the fog of trying to hire very quickly. we bypass but it's it's very crucial that we do not do that right to the best of our ability but so as you kind of do that now you're still coming in right so this is kind of pre -onboarding now we talked about what happens when they come in right but inside a threat it's not like you can have one alert right we talked about the ip over kvm stuff right like the threat actors know that we know that they're using this so they are changing their tactics so big thing about insider threats is that like you have to look at behavioral anomalies right it's not like malware here ip address here right we got them no you have to look at like over a period of time right what is the normal for them where is the base normal for them and if they deviate is it always bad maybe right but if they deviate why are they deviating there's always a reason why

30:21right and you should be able to track that and then you have to correlate the information right as we talked we talked about like hey when we're doing investigations we're actually looking back into that data set of their applicant pool right we're looking at resumes and we're looking at the activities they're doing while they're in and we're looking at kind of what are they doing what are they accessing what is out of scope for them what is what makes sense what doesn't make sense right you have to kind of try to identify that information and categorize it and then let's say that after you do all this stuff what happens well it's it's continuous lessons learned right so this may lead to you might fire someone you might call the fbi you do whatever you need to do right after you have enough data but the investigations don't happen in a vacuum right you must apply these lessons learned and go back and if you think about it like go back to what can we do better at the pre-onboarding stage what can we do better at the post-onboarding stage and then what can we do better when we catch them Because sometimes when you catch them to isolate them, to get them off your network, it's tricky.

31:26Especially if you're a global company as Cloudflare, right? If you don't have solid proof, it gets very difficult, especially with employment laws and so on and so forth, right? Your own policies, whatever the case is. So you have to have or think about these things beforehand and try to make a game plan. Now, I know I talked a lot. I hope everyone kind of took in what I had to say. So there's a very important piece here, which I'm going to pass over to Craig. He's going to talk about the organizational alignment. It's not, like I said, it's not just security team. Yeah. So Craig Stripart, I lead our incident response team, threat, Intel engineering, insider threat, red team, a couple other things. But organizational alignment, you heard from the conversation here, just from the three people talking here, like this is clearly not just security, right?

32:13You've got to have. partnerships throughout i'm gonna go to the next slide here and kind of talk through some of these partnerships that we found valuable that others i think are probably finding valuable um just going through the list here hr recruiting right some of the things ryan talked about in joe's case right he was very much using ai in his interview process so i just talked about it in some of the feedback loops and training how do you train and get your recruiters some of that information that they can then key off of to stop some of this before it even becomes a problem right if you can stop it up front all the better but you have to partner with those folks yes they're probably thinking like you know could this be an insider could this be the the remote work person we're looking out for but like the reinforcement of that is key especially for those people that are the front lines that goes for hiring managers as well right it's not just recruiting like everyone in here that's a hiring manager should be able to get that same feedback so as you're giving that feedback to HR is there broader comms that need to go out across your hiring base like hiring managers go to this wiki take this training whatever that is you catch four or five more great that's four or five more that he doesn't have to deal with and deal with all of the the mess that he just talked about uh legal privacy are there lawyers in the room anybody a lawyer want to raise their hand good we don't like them anyways I am absolutely kidding because

33:46I say that but we fight with them all the time around things like on the front end resume gathering I would like to collect as much telemetry as absolutely possible on the endpoint and the browser and everything about that user so I can take that and follow that all the way through their application process the next time they connect to Google Meet the next time they connect into whatever system we're using legal privacy says well guess what in certain countries you can't do that and only certain data and all of that so they're as much as i say i don't like them i like them because they keep us out of trouble there also are hey we found this how do we go about handling this do we need to get legal or law enforcement or fbi involved so as much as i say i don't like working with them they're very very important establish those partnerships if you haven't already uh Shrav also brought it up too. You need to exercise those things.

34:37So rather than being in the middle of, hey, we found Joe, who's obviously a problem. How do we handle this? Hey, what if we find Joe? What are we going to do? Who are we going to bring in? What evidence should we be collecting and storing and sharing with outside counsel? Who is outside counsel? Like, do I need to call Chris and get an IR engagement going because this may be... our forensics capability. So all of that is stuff that you can be planning out ahead of time. And you start that with conversations and partnerships, right? If anybody's involved in insider threat, again, it's not just a security thing. IT, they manage your endpoints, right? They have views into software that's on them. But more importantly, Joe, again, back from Ryan's presentation, hey, I actually need that laptop shift to my mom's house or I'm traveling this week, send it.

35:33to new mexico um where the other laptop farm was right so like how do we as security or it flag that and raise that like okay maybe it's legit hiring manager did you know this person's going to be in wherever instead of their oh that could have been bad um their home base right so how do we handle that how do we train them to look for those things um the other part i brought didn't bring up in hr um somebody on boards, they change their payment, where are they getting paid to from their initial bank to some random other location, to another bank account that could be DPRK, right? Or an offshore account that they just use to funnel money through. Well, how do we get in that loop? Because that's not something security would typically, like, I need to see your financial payment logs.

36:25Someone's going to look at you a little funny if you're asking for that. But if I say, hey, I'm looking for this. scenario now we can have a conversation and we can talk through the workflow of how to get that um then the business side no matter what company you work at there's the the eyes of the company are all of you all of your users the people that maybe sit next to somebody or are on a meeting with somebody teammates of somebody this person's never on camera actually they were on camera one time they didn't have an accent the second time they were when they weren't on camera around like okay now what do we do how do we report it all those processes so again the partnerships across these teams are key the other part i'll bring up sharaf highlighted it a little bit with the feedback loop but let's just take joe for example from ryan's scenario a feedback loop like after the investigation's done we get it to the authorities all of that sit every one of these groups down security hr legal business people hiring managers, whoever. Let's talk through Joe. What do we know about Joe?

37:25On the front end recruiting, what did you see? Did you have any notes in your talent management system that says, you know, I might have a concern about this guy. Like, I think he might be looking over here to gather answers, but I still passed him through because he answered everything correctly. Like, okay, maybe that's something we need to highlight. IT again with the laptop. Well, actually, requested to ship it there because of this okay now we got a flag right you can do all of this in that feedback loop and reinforce these things honestly and find new things that you may not have been looking for some of the software that we find remote access or just use is a great feedback loop into like our threat detection teams right of hey this might be new or we get something from an ESOS that says hey we're seeing new tradecraft like hey we want to put that into our systems how look for it um the the business side of things again the how do we get in front of those managers and say look we saw this happen here real life cloud flare scenario this user did this he was running long running zoom sessions again joined a joined video one time no accent second time no video accent hiring managers like this is a key right like these are key things to be looking for you have to raise this um so getting getting involved across your business is the only way this

38:56gets this is successful because there's not always going to be the alert to him if you you know heard what ryan said right like these guys are producing output if they're your top performer why would you question it right like they're doing good work let them go but there are other signals out there outside of the digital signals the digital signals are super We should continue to evolve those. But these partnerships and exercising that process, those feedback loops, as you find these insiders, go all the way back to resumes. Look at the resume. Are there things there that should be keyed on? Interviews, notes, onboarding, financials, like go back through the whole entire thing and just see if you can strengthen this program you have built and the process you've got built.

39:46exercise them make them better um yeah i mean i don't know if you guys have anything else on the organizational side no i think one interesting thing is that um you know in the experience we've had with investigating a lot of these it's very rare that it's just one person uh many times once the first person gets in they start referring additional people and we've seen nested as many as 25 people in an organization that were all parts of these kinds of groups so you know once one person gets the foot in they understand the process it's quick it's easy And the second one, to bring up your point about, there's a lot of human element in all these cases that we've worked in. I imagine it's probably been very similar for some of the stuff with Ryan is that in every one of these instances, all the red flags were there. And when you talk to the people that interacted with them, they will tell you they saw the red flags.

40:31But oftentimes people say, well, I had a deadline. I had a deliverables I had to meet. He was pushing good code. I wasn't going to rock the boat. And that's kind of a weird situation too, because now you have people who are almost willingly saying. And I'm going to accept that there's an issue, but my mission is more important. So you need to create an environment that encourages people to actually hear that things are going on and maybe not be so strict on their deliverables to where they're not going to feel compelled to share that that's there. But it's been an interesting one. And the other part is, even with all these controls in place, we've had an experience where some of these guys are taking advantage of just geopolitical issues, generating IDs without. necessarily being an actualized citizen creating personas stealing someone's information their resume generating a fake id and or legitimate id actually in another state and then shipping the laptop three houses down like these guys are smart they're not they're not novices in what they're doing and i imagine ryan you've probably got some input on that as well yep yeah i mean they're exploiting they're exploiting their remote work as a new attack surface for every company and identity is the bulwark against against that and fair ways to exploit all the different processes and systems to generate the identities.

41:38The other thing I'll just say is incentives matter a lot. Chris mentioned about, like, they're my best coder. I just sort of had to look the other way because they were doing good work. Recruiters' number one priority is to fill that job as fast as possible with the best candidate possible. They are not thinking about how to protect the business from insider risk. Hiring teams are looking for that right skill. They're exhausted having to churn through different resumes. The incentives aren't aligned. Security's best and highest purpose is to figure out how to enable those incentives to also manage risk. So for the recruiter, it's about time savings. You're spending way too much time talking to too many fake candidates. Let me take that off your plate.

42:25For the hiring manager, you're spending way too much time trying to scrutinize whether this person's using AI to answer their questions. Let me take that off your plate. For the poly worker who's trying to work multiple jobs and work across your business and expose your IP to your competitors, let me help the legal counsel reduce the exposure of that loss. And so every time security is engaging with the business, it's about helping to hack their incentives while delivering on the mission.