2. Who is Lockheed Martin?
American company with global presence
Aerospace, defense, security, and advanced technologies
World’s largest defense contractor
Involved with many various government contracts
In the US: CIA, FBI, NSA, ILS, The Pentagon, Census Bureau and Postal Service
Security of the organization is EXTREMELY IMPORTANT
5. Suspicious Access Patterns
Most users access a small set of IP addresses, at
an about equal amount.
A handful of users access only one IP address or
one IP address disproportionately to the others
accessed.
Although use of one IP is unusual, it does not
necessarily mean guilt alone.
All users with a count of IPs above the median
were examined
Suspicious
Median count of IPs
Average count of IPs
7. Employee Termination
Terminated employees are especially
suspicious
Worth looking at crossover factors
between terminated employees
Reasons for termination a factor
10. Factors for Investigation
Check outgoing calls to North Korea, Peru, and Eritrea
Cross reference with users who were fired or demoted that had suspicious IP
patterns
Compare with air travel data
Phone calls were deemed suspicious if they lasted for less than 10 minutes and were to or from a foreign country
Countries WITH Lockheed locations were judged to have zero suspicious inbound or outbound phone calls
Only suspicious phone calls are from/to countries WITHOUT Lockheed locations
Most suspicious phone calls are from/to Central and South America
Mexico is the country with the most suspicious calls
