Cyberside Chats: Cybersecurity Insights from the Experts

Inside Jobs: How CrowdStrike, DigitalMint & Tesla Got Burned

Listen Later

Insider threats are accelerating across every sector. In this episode, Sherri and Matt unpack the CrowdStrike insider leak, the two DigitalMint employees indicted for BlackCat ransomware activity, and Tesla’s multi-year insider incidents ranging from nation-state bribery to post-termination extortion. They also examine the 2025 crackdown on North Korean operatives who used stolen identities and deepfake interviews to get hired as remote workers inside U.S. companies. Together, these cases reveal how attackers are buying, recruiting, impersonating, and embedding insiders — and why organizations must rethink how they detect and manage trusted access. 

 

Key Takeaways 

  1. Build a culture of ethics and make legal consequences explicit.
    2. Use real cases — Tesla, CrowdStrike, DigitalMint — to show employees that insider misconduct leads to indictments and prison time. Clear messaging, training, and leadership visibility reinforce deterrence.
  2. Enforce least-privilege access and conduct quarterly access reviews.
    3. Limit who can view or modify sensitive dashboards, admin tools, and SSO consoles. Regular recertification ensures employees only retain the permissions they legitimately need.
  3. Deploy screenshot prevention and data-leak controls across critical systems.
    4. Implement watermarking, VDI/browser isolation, screenshot detection, and DLP/CASB rules to deter and detect unauthorized capture or exfiltration of sensitive data.
  4. Strengthen identity verification for remote and distributed employees.
    5. Use periodic identity rechecks and require company-managed, attested devices for sensitive roles. Prohibit personal-device access for privileged work to reduce impersonation risk.
  5. Monitor high-risk users with behavior and anomaly analytics.
    6. Flag unusual patterns such as off-hours access, atypical data movement, sudden repository interest, or crypto-related activity on work devices. Behavioral analytics helps uncover malicious intent even when credentials appear valid.
  6. Require your vendors to follow the same insider-threat safeguards you use internally.
    7. Ensure MSPs, SaaS providers, IR partners, and software vendors enforce strong access controls, identity verification, monitoring, and device security. Vendor insiders can quickly become your insiders.

    Resources: 

    • TechCrunch – CrowdStrike insider leak coverage: https://techcrunch.com/2025/11/21/crowdstrike-fires-suspicious-insider-who-passed-information-to-hackers/ 
      • Reuters – DigitalMint ransomware indictment reporting: https://www.reuters.com/legal/government/us-prosecutors-say-cybersecurity-pros-ran-cybercrime-operation-2025-11-03/ 
        • BleepingComputer – North Korean fake remote worker scheme: https://www.bleepingcomputer.com/news/security/us-arrests-key-facilitator-in-north-korean-it-worker-fraud-scheme/ 
          • “Ransomware and Cyber Extortion: Response and Prevention” (Book by Sherri & Matt & Karen): https://www.amazon.com/Ransomware-Cyber-Extortion-Response-Prevention-ebook/dp/B09RV4FPP9 
            • LMG’s Hiring Security Checklist: https://www.lmgsecurity.com/resources/hiring-security-checklist/ 

              • Want to attend a live version of Cyberside Chats? Visit us at https://www.lmgsecurity.com/lmg-resources/cyberside-chats-podcast/ to register for our next monthly live session. 

               

              #insiderthreat #cybersecurity #cyberaware #cybersidechats #ransomware #ransomwareattack #crowdstrike #DigitalMint #tesla #remotework

              ...more
              View all episodesView all episodes
              Download on the App Store
              Cyberside Chats: Cybersecurity Insights from the ExpertsBy Chatcyberside
              • 5
              • 5
              • 5
              • 5
              • 5

              5

              2 ratings

              More shows like Cyberside Chats: Cybersecurity Insights from the Experts

              View all
              No Agenda Show by Adam Curry & John C. Dvorak

              No Agenda Show

              5,948 Listeners

              Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec by Jerry Bell and Andrew Kalat

              Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

              370 Listeners

              The DSR Network by The DSR Network

              The DSR Network

              1,782 Listeners

              Conspirituality by Derek Beres, Matthew Remski, Julian Walker

              Conspirituality

              2,041 Listeners

              What Rough Beast by Virginia Heffernan and Stephen Metcalf

              What Rough Beast

              63 Listeners