Demonstrational Videos

Since the lab was created, we have developed a series of demonstrational videos that depict scenarios taken from real cases in the CERT database. Each video describes an insider threat case and shows how one or more open source tools could be used to detect such an incident and identify the individual responsible should it happen in your environment. We present these videos in our insider threat workshops. We have also presented them at various conferences, including the RSA Conference, the U.S. Department of Defense Cyber Crime Conference (DC3), the Government Forum of Incident Response and Security Teams (GFIRST), the Forum of Incident Response and Security Teams (FIRST), and MIS Training Institute InfoSec World.

The demos can be watched at the following URL: www.cert.org/insider_threat. We release additional demos every few months, so we recommend that you watch that site for new releases. In this chapter we will describe the insider threat mitigation strategies depicted in the demos.