Understand Cover, Understand Infiltrators

Whence this quote? "To learn how to find, one must first know how to hide." (Answer at the end.)

In the same vein, to expose infiltrators, one must first understand what they do to conceal their hostile intent and how they penetrate one's defenses to make themselves into insiders. One of their best tools is something well-conceived and meticulously inculcated: cover.

What is cover, and how well do defenders understand it? It is much more than the puerile conception of dressing and acting like one's targets. Nothing better gives away the amateur's grasp of cover than the image of a fledgling cop or case officer applying for an undercover assignment by dressing like a scruffy vagrant whose guiding objective is to look outlandishly different from a professional wearing a service uniform or the uniform of convention (a business suit). Such amateurs may eventually be schooled. But they may equally harden their yokel's belief that cover is just a game of dress-up for people who never managed to take acting classes in school.

Cover is multi-layered and can be very sophisticated. There is official cover and non-official cover. There is cover for status and cover for action. There is natural cover and cover within a cover. Cover can be part of a carefully prepared and fully backstopped legend. Good cover takes time to develop, internalize, and put to use. Sound application includes setting traps to detect when one's cover is being questioned, doubted, or blown by the target or by the opposition. Cover and plausibility are eternally conjoined.

Mastering cover means demonstrating the capacity to lead a double life, to take on a purposefully structured identity, and to arrange all one's actions to comport with that identity in the service of a mission. It is no undertaking for the impetuous, or the undisciplined, or the slow-witted.

A serious adversary bent on penetrating a target from the inside pays much more attention to developing the cover of his or her chosen infiltrator than most defenders ever pay to this subject. Superficial grasp of cover by attackers and defenders alike looks no further than appearances. Deep understanding of cover looks at appearances only as a preliminary move to a much bigger end game. An infiltrator with first-rate training and support lives the cover, defying casual exposure. This is why betting the institution’s survival on piercing the cover and spotting the malicious insider makes an inadequate defense. The better the cover, the more important it is to add multiple protective layers which have the effect of reducing the opportunity to strike – even if the adversary’s cover proves flawless. Such tactics are often called opportunity denial measures. This is where a No Dark Corners approach helps defenders offset their adversary's advantage in mastery of cover. (For details on the No Dark Corners approach, see Managing the Insider Threat: No Dark Corners, CRC Press, May 2012. Now available directly via CRC or Amazon.com.)

As for the answer to the first paragraph's question: The quote comes from the 1966 motion picture, Fahrenheit 451, based on Ray Bradbury's science fiction novel about a future where firemen ignite books as part of a larger regimentation of society and suppression of individual freedoms. The context? Training such enforcers to find banned books includes an experienced instructor advising rookies that they will improve their results if they learn to think like their opponents. So, too, is it with cover. The best – if not only – way to even begin to pierce through the cover of an able infiltrator is to start thinking like the opposition.

-- Nick Catrantzos