What is an Insider Threat?

Most people are aware that a good cyber security defense involves mitigating threats from outside your network. The often-overlooked element of security is the insider who is already behind your wall of defense. An insider is someone who has or had authorized access to your network, systems, data, or other resources. This includes current or former employees, business partners, contractors, interns, and senior executives. The insider threat occurs when an insider intentionally or unintentionally uses their access to negatively impact the organization. The weakest link in any organization is the people within it. That is what makes insider threats so dangerous and difficult to mitigate. According to the IBM Cyber Security Intelligence Index Report, 95% of cyber security breaches are caused by human error. Simple negligence can cost a company millions of dollars when it leads to data breaches and other cyber security attacks.

Types of Insider Threats

• Malicious – This is someone who knowingly abuses their authorized access to cause harm to the organization. These insiders could be disgruntled employees, former employees, or spies. Their intent is often to steal information for personal gain or revenge. Malicious insider threats may manifest as espionage, sabotage, theft, violence, or other cybercrimes. Compromised users can allow malicious outside attackers to pose as insiders once they gain access. These moles can sit inside the organization performing reconnaissance for a long time before being noticed.
• Accidental – Insiders in this category have made mistakes that can harm the organization. These insiders generally fall victim to social engineering tricks. They might accidentally click on a malicious link, open an infected attachment, or accidentally send a business email to the wrong address. These people are generally pawns used by malicious actors to gain access to the organization or cause harm to it.
• Negligent – These insiders are often careless in their actions and can expose the organization to threats. They often ignore security protocols and policies despite being familiar with them. Some examples include failing to install important security updates, not changing default passwords, and mis-placing devices storing sensitive data.

Telltale Signs Of Insider Threats

• Activity at unusual times.
• Accessing systems or applications they don’t normally use.
• Logging in from unusual locations.
• Unusually high volume of data transferred on the network.
• Unusual behavior or excessive stress in the workplace.
• Multiple security violations.
• Nonchalant attitude toward security procedures.

How to Mitigate Insider Threats

• Increased or improved employee training.
• Define clear polices for devices, data storage, and system usage.
• Revoke access immediately upon employee termination.
• Implement multifactor authentication.
• Monitor data storage areas.
• Employ user behavior analytics to track, collect, and analyze user behavior.