Earlier this summer, a cryptocurrency start-up advertised open jobs and hired three developers. The twist? The company was fake, and the developers were working on behalf of the North Korean government.
The first hire claimed he lived in Texas, but provided bank information for an account in New York, and sent an image of “his” California driver’s license created using Google Gemini. The second hire supplied a valid Social Security number, a Texas license and bank account information from Kansas. The third hire sent in an iPhone photo of a New York license that belonged to someone else, with the coordinates stripped from the image’s metadata.
The company issued virtual machines that recorded everything these employees did. Their successful placement within the organization gave them insider access to source code and internal systems. From the onboarding paperwork onward, the fake company had welcomed these insider threats inside, no exploitation required.
A team of security researchers created the fake company to underscore how nation-state threat actors can rapidly weaponize the remote hiring process to infiltrate US corporations. The rise of remote work and generative AI make these types of attacks easier to pull off than ever, and more urgent for insider threat programs to recognize and defend against.
Enable the Mission While Safeguarding It, Too
For government agencies and government contractors alike, the message is clear: insider threat programs must incorporate human judgement and technological safeguards that both protect and enable the mission.
Traditional insider threat programs assess a population of employees, even trusted populations, and monitor what’s normal and what isn’t. Numerous technology solutions exist to spot anomalies or track behavior, and paired with human judgement, teams can determine when someone has nefarious intentions or simply needs help.
As the example above illustrates, sometimes we unintentionally invite the insider threat in. Zero Trust is a security framework that treats every access request as potentially hostile, requiring continuous verification of identity, device and context before granting access. Where traditional programs catch threats after the fact, Zero Trust ensures only verified identities gain access. The two complement each other: Zero Trust provides technical controls that verify who accesses systems, while insider threat teams bring human judgment to interpret patterns and respond.
Continuous Vetting and Biometrics, Supported by Zero Trust
Recognizing the growing number of instances where hiring processes become an entry point for nation-state adversaries, the Intelligence and National Security Alliance (INSA) recently released a paper on the risks of unvetted personnel. The paper calls for a modular, scalable framework to help organizations of all sizes strengthen identity verification while accounting for cost, risk and operational realities. Zero Trust serves as an immensely powerful tool in this regard.
Given the expansion of remote work, criminal networks can more easily supply false documents or even send one person in on day-one for vetting and then have a completely different person at the keyboard performing the work. This is where advanced analytics and biometrics have a role to play, and so does Zero Trust. Under a Zero Trust framework, access is granted only after personnel have been thoroughly evaluated, verifying their identity, credentials and need-to-know. This evaluation is not a one-time gate, either; it is continuous and based off of risk indicators, serving as a technical means to strengthen any insider threat program.
At GDIT, our Everest Zero Trust solutions offer flexible, proven capabilities and expertise to accelerate Zero Trust implementation for any organization. We bring multidisciplined teams, including insider threat experts, cyber security professionals and system integrators, who perform everything from an initial evaluation to the implementation of a full suite of capabilities. We combine domain expertise with technological agility to protect humans, data and organizations from threats, no matter where they originate. And as the threat landscape changes, so too are the ways we approach it.
