3 ms·
No, at it's most basic level I mean a spy or insider threat. In the NGO contexts that I have seen that usually means someone who legitimately is works in an or
by secfirstmd 11y ago
No, at it's most basic level I mean a spy or insider threat.
In the NGO contexts that I have seen that usually means someone who legitimately is works in an organisation but turns for the standard reasons. (More effective, faster and cheaper for an adversary that way)
To a slightly lessor extent, that means someone from the outside who has been placed on the inside. (Less effective, longer and more expensive for an adversary that way).
Sometimes both of these scenarios also include digital aspects, like stealing a USB drive or something but not always.
Before you ask, why do people do it in an NGO environment - fairly similar reasons as elsewhere (though I tend to order them differently based on experience):
US Method of Counter-Intelligence:
-Money
-Ideology
-Compromise or Coercion
-Ego or Extortion
or these days:
-Reciprocation
-Authority
-Scarcity
-Commitment
-Consistency
-Liking
-Social Proof
A good read for more info here:
https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol.-57-no.-1-a/vol.-57-no.-1-a-pdfs/Burkett-MICE%20to%20RASCALS.pdf https://www.cia.gov/library/center-for-the-study-of-intellig...
- chris_wot 11y agoWell that's scary as all fuck! I didn't realise NGOs were as susceptible to this sort of thing as commercial enterprises. I guess I was being naive and should have known better. Thanks for the insights.
- secfirstmd 11y agoHonestly, in many cases NGOs actually have a far higher physical and digital security threat environment than corporations. Partly that's one of the things I love about my job. I mean yeh, it's cool if you can get paid loads of money for a 9-5 job to throw a ton of resources and people at protecting your Pied Piper software company in suburban USA or Europe....But now take the exact same advisary (China gov for example) and try to think up ways to minimise their threats all while driving around with a hobbiest sysadmin (who the local gov may arrest, torture or disappear if exposed) with very little English in the middle of the night in darkest Africa/Middle East/Asia...The pay is crap or non-existent, it can be high stress but you get to make a real difference, which is rewarding.