Welcome back to Fun with Insider Threat. Continuing with our look into Insider Threat, let's venture into the world of Flight Risk. Unlike other types of Insider Threat, Flight Risk candidates rarely have ill will towards the company they are leaving.  Most often, the motives are to retrieve all data they worked on or believe to be beneficial at their next job.  All companies, to varying degrees, claim that any work product produced on company assets or during work hours are sole property of the employer, but when leaving work the average employee does not consider this.  This seems to be especially prevalent in creative roles such as a graphic designer, for example, is judged based on the quality of their portfolio, and extracting examples of their art is pivotal to finding a new job or iterating on current work product.  

​​Insider threats can be defined as any agent within the environment employed or under contract with a company ex-filtrating, tampering, or destroying assets and/or data.  A vast majority of cyber security and audit products and techniques focus on keeping outside and unauthorized sources from accessing internal resources, but much less effort is dedicated to identity behavior patterns, motives, opportunities, and techniques through which a trusted employee might utilize to commit the same catastrophic actions. There are three traditional ways to leave a company: quit, get fired, or die.  We are going to focus on the first way, as it is the most common, unless you are the Pope, or a politician.  Summarized below are the major sources and motivations of insiders, in my experience.

As someone in the cyber/digital forensics community, I always looked at forensics training programs partially as a waste of time and (lots of) money (caveat: for someone already knowledgeable in the field). However, after some convincing from colleagues, I decided to give one a shot in December 2015. The class I participated in was SANS FOR508 (Advanced Digital Forensics and Incident Response) in Washington D.C. In addition, I signed up for the GCFA (Certified Forensic Analyst), taken in January 2016. Here are some of my thoughts now that I've gone through both of them.