122: Lisa · Darknet Diaries summary

Key takeaways

Insider threats are a significant risk in both physical venues and cybersecurity, often exploited through social engineering and manipulation.
Sophisticated attackers, including nation-states, have adapted social media platforms like LinkedIn into tools for espionage and malware delivery.
Organizations should invest in employee awareness, support systems, and proactive monitoring rather than solely relying on invasive surveillance measures.
Preparation for post-breach scenarios—detection, response, and recovery—is vital for an effective security strategy.
Trust and workplace satisfaction are key to reducing insider threat risks, as disgruntled employees or those in dark places are more vulnerable to manipulation.

Summary

The Threat of Insider Threats in Public Venues and Cybersecurity

This section discusses the underestimated danger insider threats pose to venues like music halls, stadiums, and theaters, exemplified by stories of individuals gaining unauthorized access by exploiting insiders. It explores how insiders can open side doors or wait for exits, facilitating free entry. The segment emphasizes the importance of understanding and mitigating insider threats in various security contexts, from physical venues to cybersecurity environments.

Lisa Forte’s Background and Experience in Security

Lisa Forte shares her journey from studying maritime law to working in physical security, notably in protecting ships from pirates off the Somali coast. She describes the evolving tactics of pirates, including the use of sophisticated equipment like water cannons and Long Range Acoustic Devices (L-rad) to deter attackers. Her work involved managing risks and operational defenses against pirates, which sparked her passion for security and later moved her into cybersecurity.

Piracy and Modern Maritime Defense Technologies

This section delves into Lisa’s experiences with maritime security, from anti-piracy measures like citadels and defensive weaponry to advanced devices such as L-rad, a directional sound cannon capable of inflicting pain and disorienting attackers from miles away. Her insight reflects on how attackers and defenders continually innovate, with pirates becoming highly funded and organized, akin to ransomware groups.

Transition to Cybersecurity and Insider Threats

Lisa transitioned into cybersecurity by working with UK counterterrorism and police cyber units, focusing on online radicalization and corporate security. She emphasizes insider threats, highlighting the danger of trusted employees leaking sensitive data or being manipulated through social engineering, especially via online platforms like LinkedIn and Facebook.

Insider Threats and Social Engineering Attacks

This part features detailed stories of insider threats involving complex social engineering. Lisa recounts cases where employees were manipulated through fake profiles and misinformation, leading to data leaks, espionage, or sabotage. Real-life scenarios include scientists being targeted for industrial secrets and environmental activists being duped into exposing company misconduct. These stories highlight the sophisticated tactics malicious actors use to manipulate trust.

Protecting Organizations from Insider Threats and External Manipulation

Lisa emphasizes the importance of employee training, supportive workplace environments, and proactive detection over invasive surveillance. She advocates for fostering loyalty and satisfaction among staff to reduce vulnerability. She also discusses the risks of platforms like LinkedIn being exploited for social engineering, and suggests practical steps like disabling direct messaging features to minimize attack surfaces.

Lessons and Broader Insights on Security Strategy

The episode concludes with a call for comprehensive security approaches that go beyond perimeter defense. Lisa advocates for plans that include detection, rapid response, and investigation of security breaches. She draws parallels between maritime defense and cybersecurity, stressing that preparation for after a breach is crucial for effective resilience.

Show notes

In this episode we hear some insider threat stories from Lisa Forte.

Sponsors

Support for this show comes from Axonius. Securing assets — whether managed, unmanaged, ephemeral, or in the cloud — is a tricky task. The Axonius Cybersecurity Asset Management Platform correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.

Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet.

Support for this show comes from Snyk. Snyk is a developer security platform that helps you secure your applications from the start. It automatically scans your code, dependencies, containers, and cloud infrastructure configs — finding and fixing vulnerabilities in real time. Create your free account at snyk.co/darknet.

Attribution

Darknet Diaries is created by Jack Rhysider.

Editing by Damienne. Assembled by Tristan Ledger. Sound designed by Andrew Meriwether.

Episode artwork by odibagas.

Mixing by Proximity Sound.

Theme music created by Breakmaster Cylinder. Theme song available for listen and download at bandcamp. Or listen to it on Spotify.