The Insider Threat Matrix

A:  The six insider types that may perpetrate threats:
Negligent employees: This is the most commonplace – they are usually untrained and unaware of threats such as phishing emails bearing a malicious links or attachments. Data breaches caused by negligence are primarily unintentional but place the organization at risk.

Malicious employees: As it sounds, these are disgruntled employees with a grievance against the company. To spot these, Human Resources should work with IT Support. It cannot be taken for granted that an employee who has been disciplined or passed over for a raise or promotion may harbor malicious feelings. They need to be monitored.

Departing employees: Whether the employee’s departure is voluntary or involuntary, this is a very real threat. Data (such as client information) theft and intellectual property are the two principal areas of focus, as they can enhance the departing employee’s performance at their next company. Dell performed a survey in which they found that approximately ONE THIRD of employees took company data with them when they left an organization.

Inside agents: These are nefarious because they expect to stay with the company while doing the bidding of others. Their participation could be due to social engineering, extortion, or some other type of coercion. They function the same way a spy story ‘mole’ operates.

Cybersecurity evaders: Employees who do not follow Cybersecurity policies and practices. They find ways around security measures because they are time-consuming and viewed as a hindrance. But in trying to make their jobs easier, they create ‘blind spots’ in the company’s control over its data which can lead to data breaches.

Third-party partners: Not all insider threats are truly on the inside. According to One Identity, 94% of organizations allow suppliers, vendors, and associated companies with access to their network with varying levels of permission. If you think it’s difficult to track your own employees, think about all the employees at all your third-party partners.

A: 

Unusual logins: Behavior in the workplace becomes predictable. Just like in a fairly normal-looking phishing email, anything out of place needs to be scrutinized. “Joe logs in at 8am and out at 5pm every weekday. Why is he logging in remotely at 11pm on a Saturday?”
Too many privileges: If a middle manager is assigning too many heightened permissions to employees that shouldn’t have such escalated privileges, he/she may just be trying to make their own job easier, but this places the company at risk. Employees must be on a ‘need to know’ basis.
Unusual behavior: For example, when an employee goes from happy and gregarious to sullen and quiet, something is going on. It may have no ramifications for the company, but it must be examined.
Downloading too much data: If an employee’s workstation shows a stable, steady history of data downloading, but it starts massively increasing, something is not right. Your IT Support team should routinely be checking these levels for just such increases.
Use of unauthorized applications: People don’t use what they don’t need for their job. Use – or repeated attempts to log into unauthorized applications sends up a red flag. Another area IT Support should be monitoring.

What scenario might indicate a reportable insider threat?

Aside from IT Support monitoring who is doing what on the network, behavioral issues are a prime indication. There are almost infinite ways this can manifest itself: drastic mood changes or sudden affluence (“Hey Bob – how can you afford to trade in your Toyota Camry for a Maserati?”) etc.

How are insider threats prevented?
There is no one technology that can prevent insider threats: Only ongoing vigilance from your IT Services, management, HR, and employees can sound alarm bells. Simply put, “If you see something, say something.”