Insider Threats: The Risk Right Under Your Nose

September 6, 2022

An insider threat is a security risk originating inside an organization. It usually involves a current or former employee or business associate who has privileged access to sensitive data or privileged accounts within the network of an organization and abuses this access.

Historically, security measures have focused outward in a vigilant effort to discover external threats to applications and data. As a result, many modern security postures aren’t always capable of identifying a threat emanating from the inside. In this post, we’ll profile typical insider threat actors, offer an overview of their motivations and pass along some tips for rooting them out. We’ll also suggest fundamental actions you can take to identify anomalous insider behavior and mitigate the threat it poses.

The Insider Threat Landscape

A recent Forrester report reveals that 58% of sensitive data incidents are caused by insider threats, but 82% of companies don’t have a strategy for managing them. Almost a third of organizations don’t regard insiders as a substantial threat to cybersecurity, and another 30% cite organizational indifference and lack of executive buy-in to an insider risk management strategy as factors.

Meet the Actors

How to Sniff Out Insider Threats

Anomalous data access activity at the network level may indicate danger. It’s also worth noticing when an employee appears to be dissatisfied, seems to be holding a grudge for some past slight, or even starts to take on more tasks with excessive enthusiasm. These are all behaviors that may tip you off to the existence of an insider threat. Others include:

Make Yourself a Smaller Target

It goes without saying that there are no “silver bullets'' when it comes to stopping insider threat risk, but you can start with these activities:

Secure your critical assets. These may be physical or logical and include architectures, technology, facilities and intellectual property. They also include customer and vendor data, proprietary software and sensitive internal processes.

Gain a 360-degree understanding of your critical assets. Be sure your organization knows what critical assets you possess and how they’re prioritized. Ensure you understand the current state of each asset.

Enforce policies. Comprehensively document organizational policies so you can enforce them and prevent false alarms. Everyone in the organization should be familiar with security procedures, understand their rights in relation to intellectual property and never share privileged content.

Increase visibility. Keep track of how employees typically interact with data and correlate intelligence from several data sources. For example, develop procedures to lure a malicious traitor or imposter and gain visibility into their actions.

Promote culture changes. Make data security savvy and ensure your organization’s security core values. Combat negligence and address the drivers of malicious behavior. Provide ongoing education on security issues and work to improve employee satisfaction.

Find a Sustainable Mitigation Solution

In addition to the activities above, we recommend enhancing your insider threat detection strategy with tools to not only monitor behavior, but also filter through the large number of alerts and false positives. User behavior analytics can establish a baseline for normal data access activity, while database activity monitoring can help identify policy violations. Employing these as part of a larger overall application and data security strategy should set you on a path to continually improving your security posture from the inside, out.