Insider Threat: Tips and Tricks from a Bad Guy ™ as a Service

Insider Threat: Tips and Tricks from a Bad Guy ™ as a Service

Speakers: Sara Lelliot

Conference: CrikeyCon

YouTube: https://www.youtube.com/watch?v=bs5nCBDxAsc

Overview

In this compelling CrikeyCon presentation, security researcher Sara Lelliot delves into the often-overlooked yet critically important domain of insider threat, approaching it from the unique perspective of an attacker. Titled "Insider Threat: Tips and Tricks from a Bad Guy ™ as a Service," Lelliot masterfully weaves together insights from psychology, people management, and cybersecurity to expose the human vulnerabilities that organizations frequently neglect. Her talk goes beyond conventional technical controls, arguing that the true weakest link in an organization's security posture is often its own people, not due to malice alone, but due to systemic issues affecting psychological safety.

Lelliot, with nearly 15 years in security research spanning critical infrastructure, financial services, and government sectors, draws upon her extensive experience in red teaming engagements to illustrate how human factors can be exploited. She provides a stark reminder that while organizations invest heavily in technology and processes, the "people" element remains a potent attack vector. By sharing real-world case studies, Lelliot demonstrates how a nuanced understanding of human behavior and cognitive biases can enable attackers to bypass even robust technical defenses.

The significance of this talk lies in its profound shift of focus. Instead of solely discussing technical exploits or complex malware, Lelliot champions the concept of psychological safety as a fundamental cybersecurity control. She posits that fostering an environment where employees feel empowered to speak up, ask questions, and report risks without fear of repercussion is not just a matter of good workplace health and safety, but a vital component of a resilient security strategy. This perspective challenges conventional thinking, urging security professionals to integrate human-centric approaches into their defense mechanisms to mitigate the pervasive and often invisible threat from within.

Background

▶ Watch: Introduction and speaker's personal hacking journey (0:00)

The concept of an insider threat is a pervasive and often underestimated challenge in organizational security. While many security strategies focus on external adversaries attempting to breach defenses from the "outside," Lelliot highlights the critical reality that "the bad guy could already be in the building." An insider threat is defined as a security risk posed by individuals who have authorized access to an organization's assets and intentionally (malice) or unintentionally (negligence, human error) cause harm or create vulnerabilities. This can range from a logic bomb planted by a disgruntled employee to accidental data exposure.

Lelliot underscores the gravity of this issue by referencing recent Australian data breaches, citing prominent examples such as UNSW, Medibank, Optus, Latitude, and St. Vincent's Hospital. According to the Notifiable Data Breach Report 2024 by the Office of the Australian Information Commissioner (OAIC), heavily regulated industries like healthcare and finance are disproportionately affected, often due to the "tasty data" they hold. Critically, the report indicates that a significant portion of these breaches are attributed to either malicious criminal attacks or human error. While human error might include accidental misconfigurations or misdirected emails, Lelliot's focus is on the intersection of human factors and malicious intent, particularly how human vulnerabilities can be leveraged by external or internal actors.

Traditional organizational problem-solving often relies on the "people, process, and technology" (P-P-T) model. Lelliot observes that organizations typically excel at getting the technology right, implementing controls like Web Application Firewalls (WAFs) and Endpoint Detection and Response (EDR) solutions. They also diligently refine processes through continuous security improvement and annual reviews. However, as a "bad guy," Lelliot asserts that the people element frequently represents the weakest link, ripe for exploitation. This forms the foundational premise of her talk: understanding and addressing the human side is paramount for truly robust security.

To illustrate these points, Lelliot draws upon her experience in red teaming engagements. She clarifies that a red team engagement is a security assurance exercise, distinct from an internal red team, designed to test the efficacy of people, process, and technology, as well as the blue team's defensive capabilities. These engagements involve attempting to breach an organization based on negotiated scenarios, capturing "flags" or achieving specific objectives. Lelliot distinguishes between threat emulation, where attackers mimic known Tactics, Techniques, and Procedures (TTPs) of specific threat actors, and threat simulation, which allows red teamers broader judgment in their attack methods. Her case studies are rooted in threat simulation, emphasizing the creative and adaptive nature of human-centric attacks.

Key Findings

▶ Watch: Red teaming: Automotive industry social engineering (5:40)

The central and most impactful finding of Sara Lelliot's talk is the profound correlation between an organization's psychological safety and its overall security posture. Lelliot posits that while technical controls and robust processes are essential, they are insufficient without a workplace culture that empowers employees to operate without fear. She argues that the lack of psychological safety creates a critical vulnerability, making employees susceptible to social engineering and, in extreme cases, fostering environments where disgruntled insiders might emerge.

Lelliot's red team engagements serve as compelling evidence for this finding. In both scenarios, the success of the physical and digital breaches hinged entirely on exploiting human behavior, specifically leveraging fear, urgency, and perceived authority. She demonstrates that when employees feel threatened (e.g., fear of repercussions from head office) or when organizational issues lead to shortcuts (e.g., taping doors open, ignored repair requests), they become more prone to making emotional decisions rather than logical, security-conscious ones. This emotional susceptibility, Lelliot explains, is where an attacker can "pop a human shell," effectively bypassing technical safeguards by manipulating individuals.

Furthermore, Lelliot highlights that psychological safety is not merely a "soft skill" or a benefit for employee well-being; it is a fundamental security control. Referencing Google's Project Aristotle, which identified psychological safety as the number one factor for high-performing teams, she extends this finding to cybersecurity. An environment where employees feel safe to ask questions, challenge ideas, innovate, and, crucially, report risks without fear of blame or humiliation, directly strengthens an organization's defense against insider threats and social engineering. Conversely, a lack of psychological safety creates a "weak spot in the armor," rendering even advanced security technologies less effective if the human element is compromised. This finding challenges the industry to integrate human-centric cultural considerations directly into their cybersecurity frameworks.

Technical Deep Dive

▶ Watch: Analysis: How social engineering exploits cognitive biases (12:50)

Lelliot's "Tips and Tricks from a Bad Guy" provide a deep dive into the technicalities of exploiting human psychology through social engineering. She defines social engineering as "the use of psychological influence on people to trick them into performing actions or divulging confidential information." This isn't about code or network exploits; it's about the sophisticated manipulation of human cognitive processes.

A crucial component of Lelliot's methodology is Open Source Intelligence (OSINT). Before any direct interaction, extensive OSINT is performed to gather "delicious tasty data" that requires minimal technical skill to acquire. This includes:

• Floor plans: Understanding physical layouts.
• Staff organizational structures: Identifying roles, reporting lines, and potential targets.
• Company acquisitions/restructures: Detecting periods of employee dissatisfaction or uncertainty, often found on platforms like GlassDoor. This information is vital for developing a credible pretext – a fabricated scenario used to deceive targets.

The core of Lelliot's social engineering technique lies in leveraging cognitive biases, which are systematic tendencies to act in irrational ways due to our limited ability to process information objectively. These biases can cloud judgment and perception of risks. Lelliot specifically highlighted three biases used in her engagements:

1. Authority Bias: People tend to trust and follow those they perceive as having authority, even if that authority is fake or unverified. In her automotive industry case study, Lelliot successfully impersonated someone "sent from the parent company to audit the group," a classic application of authority bias. The workers, fearing repercussions from "head office," did not question her, granting her unfettered access. In the critical infrastructure example, her claim of being a "third-party vendor" assessing security also played on this bias, leading a worker to willingly guide her to a sensitive control room.

1. Scarcity Bias: The perception of limited resources or opportunities can lead to impulsive decisions. Social engineers can create a sense of urgency or exclusivity. Lelliot alluded to this by suggesting a pretext like, "Hey, we're here to help you fix your security. Tell me all where all your holes are and we'll fix it for you. We'll talk to the board and sort it out." This creates a perception of a unique, time-sensitive opportunity to address problems, making targets more cooperative and less critical.

1. Social Proof Bias: People tend to follow the actions and opinions of others, especially if they perceive them as similar or trustworthy. Lelliot offered a key piece of tradecraft for red teamers: sending two consultants for in-person engagements. The presence of a second, seemingly legitimate individual creates a sense of social proof, reinforcing the credibility of the imposters and making their story appear more legitimate, particularly if they are comfortable bouncing off each other.

These psychological techniques, combined with meticulous OSINT and a well-crafted pretext, form the "technical" backbone of Lelliot's insider threat exploitation. They demonstrate that the most sophisticated attacks often target the human operating system rather than the digital one, turning perceived organizational weaknesses (like fear or a desire to be helpful) into critical security vulnerabilities.

Demo / Proof of Concept

▶ Watch: Psychological safety: A critical security control (16:20)

Sara Lelliot demonstrated the efficacy of her insider threat techniques through two distinct red team engagements, each serving as a powerful proof of concept for exploiting human vulnerabilities.

Case Study 1: Automotive Industry (Fairly Scoped)

This engagement was likened to a "standard gym leader Pokémon battle," implying a relatively straightforward but effective approach against typical threats like activists or script kiddies. The objective was to test the organization's defenses against a common infiltration scenario.

1. OSINT and Pretext Development: Lelliot began with extensive OSINT, gathering information on floor plans, organizational structures, recent acquisitions, and employee sentiment (e.g., from GlassDoor). This intelligence revealed potential employee dissatisfaction due to a parent company-driven restructure. Based on this, she crafted her pretext: she was an auditor sent from the parent company, or a third-party vendor if questioned on specifics.

1. Site 1 Execution:

• Lelliot created a fake letter using Photoshop with a forged signature, stating she was auditing the site.
• Upon arrival, workers, likely fearing "head office," showed her the bathrooms, where to plug in her machine, and then left her unattended in the server room.
• Within under 30 minutes, she gained access to data and observed lax visitor policies.

1. Site 2 Execution:

• This site proceeded even smoother. Lelliot signed in and was shown to the manager's office, where she was again left unattended.
• She discovered passwords on a post-it note stuck underneath the keyboard.
• Using these credentials, she gained access to internal systems, compromising sales performance data, customer data, staff data, and company credit card data.
• She also used the manager's email to send herself an email as evidence.
• This entire operation took under 10 minutes.

These two scenarios vividly demonstrated how simple social engineering, combined with poor physical security and human habits (like post-it notes), could lead to rapid and comprehensive data breaches, exploiting the authority bias and fear of employees.

Case Study 2: Critical Infrastructure (Elite Four-level Scoping)

This engagement was significantly more challenging, comparable to an "elite four-level scoping" or "end boss" scenario. The win condition was a "true critical" where loss of life could occur, focusing on a physical breach with no destructive testing, no lock-picking tools, and only in-person social engineering (no phishing). Crucially, Lelliot was not allowed to touch a computer, making it a pure test of human and physical controls. The ultimate goal was to reach a "control room."

1. Initial Infiltration:

• The team approached the site on a weekend, taking advantage of reduced security presence in the car park.
• They found a side door and used a shove tool to gain entry.
• They became trapped in a hallway with another locked door.

1. First Social Engineering Encounter:

• A worker approached them in the hallway. Lelliot, facing imminent capture, employed a bold social engineering tactic: she looked him in the eye and said, "Goodday."
• The worker immediately looked down, responded "hello," and kept walking, averting the immediate crisis. This demonstrated how a confident, unexpected, and simple interaction can disarm a potential challenger.

1. Internal Navigation and Key Pass Acquisition:

• After eventually getting the shove tool to work, they entered the main office. They found no helpful maps.
• Lelliot discovered a room with the door taped open, and inside, on a desk, a key pass.
• She took the key pass and used it to access a locked hall.

1. Second Social Engineering Encounter & Objective Achievement:

• The same worker from before reappeared, asking, "Excuse me."
• Lelliot immediately engaged, employing her "best smiley face." She identified herself as a "third-party vendor" assessing security, complimented the worker (assuming he was from IT), and directly asked for help finding the "control room."
• The worker, influenced by her confident (fake) authority and apparent need for help, responded, "You're here. Let me let you in," and led her directly to the control room, achieving the primary objective.
• When Lelliot took photos, he questioned it, but she dismissed his concern with a confident "Oh, but I do."

1. Exit Strategy and Further Reconnaissance:

• As they were leaving, they were stopped by a security guard.
• Lelliot confidently informed him they were "doing an audit on security controls of the building."
• The security guard was "pleased and psyched" that someone was fixing issues and proceeded to walk them around the entire site, pointing out broken alarms and doors, and other security gaps.
• The team was in and out in an hour, having not only achieved their objective but also gathered extensive vulnerability intelligence.

These engagements powerfully illustrate how cognitive biases (authority, social proof), combined with a lack of psychological safety (taped-open doors, ignored repair requests indicating a culture of cutting corners or ignored concerns), can be leveraged to bypass stringent physical and logical controls, even in high-stakes environments. The "Goodday" tactic and the subsequent direct request for help highlight the effectiveness of confident, contextually appropriate social engineering in manipulating human trust and helpfulness.

Defensive Implications

▶ Watch: Challenge: Foster psychologically safe work environments (19:00)

The insights from Sara Lelliot's talk offer profound defensive implications, shifting the focus from purely technical controls to the critical role of human factors and organizational culture. The primary takeaway for defenders is that psychological safety is not just an HR concern; it is a fundamental cybersecurity control.

1. Prioritize Psychological Safety as a Security Control:

• Organizations must actively foster an environment where employees feel comfortable expressing ideas, concerns, and mistakes without fear of negative repercussions (punishment, humiliation, being shut down).
• This aligns with Australian workplace health and safety laws and is proven by studies like Google's Project Aristotle to be the number one factor for high-performing teams.
• A psychologically safe environment empowers employees to ask questions, challenge ideas, innovate, and, crucially, report risks – whether it's a suspicious email, a strange person on-site, or a vulnerability they've discovered. Without this, potential threats remain hidden.

1. Strengthen "People" in the P-P-T Model:

• While organizations typically invest heavily in technology (WAFs, EDR, DLP, Entity Behavior Analytics, monitoring, threat detection) and processes (regular access reviews, secure onboarding/offboarding, "challenge without a pass" policies), these are insufficient if the "people" element is neglected.
• A robust security awareness program is essential, but it must be delivered in conjunction with psychological safety. If employees are not engaged or fear reporting, even the best training will fail.
• Training should focus on recognizing and resisting social engineering tactics by understanding cognitive biases. It should also empower employees to question perceived authority and challenge suspicious requests.

1. Implement Zero Trust Principles Holistically:

• Lelliot advocates for a Zero Trust approach, assuming "no user or device is trustworthy." While this is often applied to network and access management, it must extend to human interactions.
• This means implementing stringent physical security protocols, verifying identities, and having policies that encourage challenging unfamiliar individuals, even if they appear to have authority. The "challenge without a pass" policy is a good example.

1. Address Organizational Culture and Leadership:

• The talk highlights that issues like fear of head office, cutting corners (taped-open doors), or ignored requests for repairs are symptoms of a deeper cultural problem. Leaders must address these systemic issues.
• Managers, in particular, play a critical role in listening to their teams and gaining buy-in, fostering an environment where employees feel valued and heard, reducing resentment that could be exploited.

1. Improve OSINT Awareness and Countermeasures:

• Organizations should be aware of the type of information publicly available about them (e.g., GlassDoor reviews, floor plans, organizational charts) and take steps to manage their public digital footprint where appropriate.
• Educating employees about the risks of oversharing information about workplace dynamics or internal structures online is also important.

By integrating psychological safety into the core of cybersecurity strategy, organizations can build a more resilient defense against the most sophisticated and adaptive threats – those that target human nature. This requires a cultural shift, empowering every employee to be an active and willing participant in the organization's security posture.

Key Takeaways

• Psychological Safety is a Core Security Control: Fostering an environment where employees feel safe to report risks, ask questions, and challenge ideas without fear of reprisal is paramount to strengthening an organization's overall security posture against insider threats and social engineering.
• Human Factor is the Weakest Link: Despite robust technical controls and processes, the "people" element remains the most exploitable vulnerability, often targeted through sophisticated social engineering techniques that leverage cognitive biases.
• Social Engineering Exploits Cognitive Biases: Attackers effectively manipulate human tendencies like authority bias, scarcity bias, and social proof bias to gain access, information, or influence, bypassing traditional security measures.
• OSINT is Foundational for Pretexting: Extensive Open Source Intelligence (OSINT) gathering, including information from sources like GlassDoor, is critical for developing credible pretexts that exploit organizational dynamics and employee sentiments.
• Comprehensive Defense Requires P-P-T Integration: Effective security demands a holistic approach that not only focuses on technology and processes but critically integrates a strong, psychologically safe "people" component, supported by robust security awareness programs.
• Every Individual Contributes to Security: From students to managers, everyone has a role in cultivating a psychologically safe environment, which directly contributes to the organization's resilience against insider threats.

About the Speaker(s)

Sara Lelliot, known by her handle "Musk," is an accomplished security researcher with nearly 15 years of experience in the field. Based in Sydney, Gatagle, she has dedicated the last eight and a half years to consulting across various sectors, including critical infrastructure, financial services, and government. For the past four years, she has been an integral part of an internal security team. Lelliot's journey into cybersecurity began with an early obsession with hacking video games, evolving into bypassing high school IT controls. Initially studying psychology at university, she later fell down the cybersecurity "rabbit hole" after attending local 2600 meetups. Her unique background in psychology deeply informs her understanding and approach to security, particularly regarding human vulnerabilities and social engineering. Outside of her professional pursuits, Lelliot enjoys coffee and Skyrim.