An insider threat refers to when a current or former employee, contractor, or business partner misuses their access to compromise your company’s data and systems. Insider threats pose a significant risk as these individuals already have access to sensitive information and systems. Companies need to take proactive steps to guard against insider threats.
Understanding the Risks of Insider Threats
There are many types of insider threats a company needs to be aware of:
-
Malicious insiders – These insiders intentionally steal data or sabotage systems. They may be motivated by greed, revenge, ideology, or espionage.
-
Negligent insiders – Well-meaning insiders who fail to follow security policies and inadvertently expose data or systems. This can include mishandling data, using weak passwords, or falling for phishing emails.
-
Compromised insiders – Insiders who have their credentials or devices compromised by external threat actors to gain access.
Insider threats are especially dangerous because:
-
They understand the organization’s systems and data. They know where the “crown jewels” are stored.
-
They frequently have privileged access through normal duties. This gives them access to sensitive systems and data.
-
Their actions can be hard to separate from normal activity. Malicious activity may only represent a small fraction of overall behavior.
-
There is often less monitoring and auditing of insider activity. External threats are more closely scrutinized.
Developing an Insider Threat Program
Guarding against insider threats requires a multifaceted program:
Assign Responsibility
-
Appoint a senior leader as responsible for the insider threat program. This gives the program executive oversight.
-
Establish an insider threat team with representatives from HR, legal, IT, security, and other areas. This cross-functional team can holistically address insider threats.
Conduct Risk Assessments
-
Classify your data based on sensitivity and perform risk assessments on systems holding sensitive data. Understand your critical assets.
-
Review access privileges to ensure users only have access appropriate for their role. Reassess access when employees change roles.
-
Identify high risk users such as recently terminated employees, employees undergoing performance management, users with privileged access, and those with access to multiple systems.
Implement Technical Controls
-
Monitor user activity for signs of suspicious access or behavior, especially for high risk users and systems. This includes endpoint monitoring and network analysis.
-
Control access with principle of least privilege, separation of duties, and tools like data loss prevention.
-
Protect credentials by securing root and admin accounts, using passphrases, and employing multi-factor authentication.
Raise Security Awareness
-
Train employees to identify and report potential insider threats through security awareness programs.
-
Inform employees of responsibilities to handle data properly, protect credentials, and report suspicious activity.
-
Communicate insider threat program and consequences for policy violations to deter malicious activity.
Detect and Respond
-
Monitor for red flags like unauthorized access attempts, copying data, unexplained affluence, or threats of violence.
-
Investigate anomalies through log analysis, interviews, and forensic examination. Involve HR, legal, and incident response teams.
-
Develop incident response plans to contain, eradicate, and recover from insider attacks. Preserve evidence via system isolation and forensic image acquisition.
Implementing Policies and Controls
Formal policies and controls are key for an insider threat program:
Least Privilege Access
-
Limit access to only what is needed for legitimate duties. Remove unnecessary access privileges.
-
Segregate duties so no single person has end-to-end control of sensitive transactions.
-
Promptly disable access when employees change roles or leave the company.
Monitoring and Logging
-
Log access to sensitive systems. Save logs for at least 90 days.
-
Monitor for suspicious access like unusual hours, volumes, or locations.
-
Detect unauthorized copying of data like large transfers to usb drives.
-
Alert on high-risk events like repeated failed logins, unauthorized location, etc.
Secure Credentials and Authentication
-
Enforce strong passphrases that are at least 12 characters. Ban common passwords.
-
Employ multi-factor authentication (MFA) especially for privileged accounts and remote access.
-
Store passwords securely by using password managers or hash storage.
Incident Response
-
Develop insider threat incident response plans covering detection, containment, eradication, and recovery steps.
-
Assemble an incident response team with representatives from IT, HR, legal, executives, PR, and forensics.
-
Train staff on warning signs of insider threats and proper incident reporting procedures.
Final Thoughts
Insider threats represent a significant yet often overlooked risk for companies. By taking a structured approach that combines policies, technical controls, and education, organizations can mitigate potential insider attacks. Ongoing vigilance and adaptation is key in this evolving threat landscape.
