Successfully reported this slideshow.
You’ve unlocked unlimited downloads on SlideShare!
Phone calls were deemed suspicious if they lasted for less than 10 minutes and were to or from a foreign country Countries WITH Lockheed locations were judged to have zero suspicious inbound or outbound phone calls Only suspicious phone calls are from/to countries WITHOUT Lockheed locations Most suspicious phone calls are from/to Central and South America Mexico is the country with the most suspicious calls
Jessica Morris, Zeyad Negash, Noelle Browne, Sarah Grandfield
Who is Lockheed Martin?
American company with global presence
Aerospace, defense, security, and advanced technologies
World’s largest defense contractor
Involved with many various government contracts
In the US: CIA, FBI, NSA, ILS, The Pentagon, Census Bureau and Postal Service
Security of the organization is EXTREMELY IMPORTANT
Suspicious Access Patterns
Most users access a small set of IP addresses, at
an about equal amount.
A handful of users access only one IP address or
one IP address disproportionately to the others
Although use of one IP is unusual, it does not
necessarily mean guilt alone.
All users with a count of IPs above the median
Median count of IPs
Average count of IPs
Terminated Employees With Single IP
Address Counts > 300
Factors for Investigation
Check outgoing calls to North Korea, Peru, and Eritrea
Cross reference with users who were fired or demoted that had suspicious IP
Compare with air travel data