Insider Threats

1. Introduction to Insider Threats

An insider threat is a security risk involving a person who
has legitimate or otherwise trusted access to an organization’s systems,
facilities, information or resources.

The person may be an employee, contractor, temporary worker, administrator,
partner or another authorized user.

An insider threat does not necessarily mean that the person intentionally
wants to cause harm. Insider risk can result from malicious actions,
negligence, mistakes or the compromise of a legitimate account.

2. Why Insider Threats Matter

Traditional cybersecurity controls often focus heavily on unauthorized
external access. Insider-risk management recognizes that authorized users
may already have access to valuable resources.

A legitimate account can potentially access systems, files or applications
that an unknown external attacker would first need to compromise.

3. Types of Insider Threats

Three broad categories are useful when studying insider risk:

• Malicious insider: A person intentionally misuses authorized access.
• Negligent insider: A person creates risk through mistakes, carelessness or failure to follow security procedures.
• Compromised insider: A legitimate account or device is controlled by an external attacker.

4. Malicious Insiders

A malicious insider may intentionally steal information, damage systems,
disclose confidential material or misuse organizational resources.

Examples may include unauthorized copying of sensitive information or
deliberately changing important records.

Security teams should focus on observable evidence rather than assumptions
about a person’s motives.

5. Negligent Insiders

Negligent behavior can create serious security problems even when there is
no intention to cause harm.

Examples include:

• Sharing passwords.
• Leaving sensitive documents exposed.
• Sending information to the wrong recipient.
• Using unauthorized software.
• Ignoring security updates.
• Using weak or reused passwords.
• Failing to report suspicious activity.

6. Compromised Accounts

A compromised account can appear to be an insider activity because the
attacker is using a legitimate identity.

For this reason, security teams should distinguish between the
identity being used and the person actually using
that identity.

7. Common Causes of Insider Risk

• Excessive permissions
• Weak authentication
• Password reuse
• Phishing
• Malware
• Poor offboarding
• Uncontrolled file sharing
• Unmanaged devices
• Insufficient security awareness
• Weak access-review processes

8. Principle of Least Privilege

Least privilege means giving a user, process or system only
the access required to perform an authorized task.

If an account only needs access to a particular application, there may be no
reason for that account to have unrestricted administrative access to unrelated
systems.

9. Privileged Accounts

Privileged accounts can perform administrative or security-sensitive actions.

Examples include:

• Domain administrators
• Database administrators
• Cloud administrators
• Network administrators
• Security administrators
• System administrators

Because privileged accounts can have significant impact, they require stronger
controls and closer monitoring.

10. Privileged Access Management

Privileged Access Management (PAM) is a collection of practices and
technologies used to control and monitor privileged access.

Common concepts include:

• Separate administrative accounts
• Strong authentication
• Just-in-time access
• Session monitoring
• Credential protection
• Access approval
• Periodic access review

11. Separation of Duties

Separation of duties means dividing sensitive responsibilities
among different people or roles so that one person does not have unnecessary
control over an entire process.

For example, one employee may prepare a transaction while another authorized
employee approves it.

12. Access Reviews

Organizations should periodically review who can access important systems and
information.

Access reviews can identify:

• Unused accounts
• Former employees
• Excessive privileges
• Unnecessary group memberships
• Stale contractor accounts
• Unexpected administrative privileges

13. Employee Onboarding

Security begins when an account is created.

New employees should receive only the access required for their role and
should receive appropriate security-awareness training.

14. Employee Offboarding

When a person leaves an organization, access should be removed or disabled
according to the organization’s approved offboarding procedure.

Important areas may include:

• Email accounts
• VPN access
• Cloud applications
• Database access
• Physical access cards
• Privileged accounts
• API credentials
• Shared systems

15. Shared Accounts

Shared accounts make accountability more difficult because multiple people may
use the same identity.

Where practical, organizations should use individual accounts and appropriate
audit trails.

16. Authentication and MFA

Multi-factor authentication can reduce the risk of unauthorized account use.

MFA is particularly important for administrative accounts and access to
sensitive systems.

However, MFA does not eliminate insider risk because an authorized user may
still misuse legitimate access.

17. Data Access

Sensitive information should be accessible only to authorized users with a
legitimate business or operational need.

Examples include:

• Customer information
• Financial records
• Source code
• Authentication secrets
• Business documents
• Personal information
• Security configurations

18. Data Loss Prevention

Data Loss Prevention (DLP) technologies and procedures can
help identify or control certain forms of sensitive-data movement.

Depending on the environment, DLP controls may monitor transfers through
email, cloud storage, removable media or other channels.

19. Logging

Security logs provide evidence about system activity.

Useful events can include:

• Successful logins
• Failed logins
• Privilege changes
• File access
• Data exports
• Configuration changes
• Administrative actions
• Account creation
• Account deletion

20. User and Entity Behavior Analytics

User and Entity Behavior Analytics (UEBA) attempts to identify unusual
behavior by comparing activity with established patterns.

For example, an account that normally accesses a small number of files may
suddenly access an unusually large number of sensitive records.

An anomaly is not automatically proof of malicious activity. Legitimate
business events can also produce unusual behavior.

21. Possible Indicators of Insider Risk

Examples of indicators that may deserve investigation include:

• Unexpected privilege changes
• Large unusual data transfers
• Access outside normal working patterns
• Repeated access to unrelated sensitive systems
• Creation of unusual accounts
• Repeated security-policy violations
• Unexpected use of administrative tools
• Attempts to bypass security controls

These indicators require context and should not be treated as automatic
evidence of wrongdoing.

22. Privacy and Monitoring

Security monitoring should be designed carefully because employees and other
authorized users may have legitimate privacy interests.

Organizations should define appropriate monitoring purposes, collect only
necessary information where possible, protect monitoring data and follow
applicable laws, regulations and organizational policies.

23. Monitoring Does Not Mean Constant Surveillance

Effective security monitoring focuses on relevant security events rather than
collecting unlimited information about users.

A balanced approach helps organizations protect systems while respecting
privacy and maintaining trust.

24. Incident Investigation

When suspicious activity is identified, investigators should preserve relevant
evidence and establish a timeline.

A basic investigation may examine:

1. Which account was involved?
2. Which device was used?
3. What resources were accessed?
4. When did the activity occur?
5. Was the access authorized?
6. Was the account compromised?
7. What changes occurred?
8. What evidence supports the conclusion?

25. Account Compromise vs Insider Misuse

Consider two possibilities when an employee account behaves unusually:

• The employee intentionally performed the activity.
• An external attacker obtained control of the account.

Investigators should collect evidence before deciding which explanation is
supported.

26. Access Control Models

Organizations may use different access-control models.

• RBAC: Role-Based Access Control assigns permissions based on roles.
• ABAC: Attribute-Based Access Control considers attributes such as user, resource, action or environment.
• Least privilege: Access is minimized according to actual requirements.

27. Role-Based Access Control

In an RBAC system, users receive permissions through roles.

For example:

• Student
• Trainer
• Administrator
• Finance Officer
• Security Analyst

Each role should receive only the permissions necessary for its legitimate
responsibilities.

28. Security Awareness

Employees are an important part of an organization’s security architecture.

Security-awareness training should cover:

• Phishing recognition
• Password security
• MFA
• Safe data handling
• Reporting suspicious activity
• Device security
• Physical security
• Acceptable-use policies

29. Physical Insider Threats

Insider risk is not limited to computer systems.

Physical risks can involve:

• Unauthorized entry
• Tailgating
• Removal of equipment
• Unauthorized photography
• Access to printed records
• Improper disposal of documents

30. Endpoint Controls

Endpoint security controls can reduce insider-related risks.

• Endpoint detection and response
• Antimalware
• Device encryption
• Application control
• USB controls
• Patch management
• Security logging

31. Network Segmentation

Network segmentation limits the ability of a user or compromised device to
reach unrelated systems.

For example, student devices may be placed on a different network from
servers containing sensitive administrative information.

32. Zero Trust Concepts

Zero Trust is based on the principle that access should not automatically be
trusted simply because a user or device is inside a network.

Common Zero Trust concepts include:

• Verify explicitly
• Use least privilege
• Assume breach
• Continuously evaluate access
• Segment resources

33. Insider Threat Scenario

Imagine a fictional organization where an employee normally accesses ten
internal documents each day.

One evening, the account accesses several hundred sensitive documents and
attempts to transfer a large amount of information to an unfamiliar location.

This behavior should trigger an investigation, but it should not automatically
be interpreted as proof of malicious intent.

The security team should examine the account, device, authentication logs,
business context and other available evidence.

34. Synthetic Risk Analysis Example

The following PHP example analyzes fictional account-risk data. It does not
access real accounts or systems.

<?php

$account = array(
	'mfa_enabled'             => true,
	'recent_password_change'  => false,
	'suspicious_login_count'  => 3,
	'is_privileged'           => true,
	'large_data_transfer'     => true,
);

$risk_score = 0;

if ( ! $account['mfa_enabled'] ) {
	$risk_score += 2;
}

if ( $account['recent_password_change'] ) {
	$risk_score += 1;
}

if ( $account['suspicious_login_count'] > 0 ) {
	$risk_score += 2;
}

if ( $account['is_privileged'] ) {
	$risk_score += 2;
}

if ( $account['large_data_transfer'] ) {
	$risk_score += 3;
}

echo 'Synthetic risk score: ' . (int) $risk_score . '<br>';

if ( $risk_score >= 6 ) {
	echo 'Result: Review recommended.';
} else {
	echo 'Result: Continue normal monitoring.';
}

35. Important Limitation of Risk Scores

A numerical score is only an investigation aid. It should not automatically
determine that a person is malicious.

Security teams should combine technical evidence, business context and
approved investigation procedures.

36. Insider Threat Prevention Framework

A strong defensive program can include:

1. Identity and access management.
2. Least privilege.
3. Strong authentication.
4. Multi-factor authentication.
5. Access reviews.
6. Security awareness.
7. Endpoint protection.
8. Network segmentation.
9. Logging and monitoring.
10. Incident response.
11. Secure onboarding.
12. Secure offboarding.
13. Data protection.

37. Secure Offboarding Checklist

• Disable required user accounts.
• Remove unnecessary group memberships.
• Revoke sessions and tokens where appropriate.
• Disable VPN access.
• Recover organizational devices.
• Remove physical access.
• Review privileged access.
• Transfer approved business responsibilities.
• Protect organizational data.
• Document completion of the process.

38. Secure Onboarding Checklist

• Create an individual account.
• Assign the correct role.
• Apply least privilege.
• Enable MFA where required.
• Provide security awareness training.
• Configure approved devices.
• Document authorized access.
• Explain reporting procedures.

39. Authorized Classroom Exercise

Create a fictional organization containing several synthetic users.

For each fictional user, record:

• Role
• Privilege level
• MFA status
• Number of failed logins
• Number of sensitive files accessed
• Recent access changes
• Offboarding status

Students should identify which records deserve additional investigation and
explain why the available evidence does not automatically establish malicious
behavior.

40. Security Response to Suspected Insider Risk

1. Confirm the alert or reported event.
2. Preserve relevant logs and evidence.
3. Determine the scope of access.
4. Check whether the account was compromised.
5. Apply approved containment measures.
6. Protect affected information.
7. Escalate according to organizational policy.
8. Document findings.
9. Review controls after the incident.

41. Common Mistakes Organizations Make

• Giving users excessive privileges.
• Failing to remove former employees’ access.
• Ignoring dormant accounts.
• Using shared administrator accounts.
• Failing to review permissions.
• Collecting logs without monitoring them.
• Ignoring compromised-account scenarios.
• Using security monitoring without appropriate privacy safeguards.

42. Review Questions

1. What is an insider threat?
2. What is a malicious insider?
3. What is a negligent insider?
4. What is a compromised insider?
5. Why is least privilege important?
6. What is separation of duties?
7. Why are privileged accounts sensitive?
8. What is RBAC?
9. Why are access reviews necessary?
10. Why is offboarding important?
11. How can MFA reduce account-related risk?
12. What is the purpose of logging?
13. What is UEBA?
14. Why is an anomaly not automatically proof of malicious behavior?
15. How can network segmentation reduce insider risk?
16. What is the relationship between insider risk and compromised accounts?
17. Why should employee monitoring consider privacy?

43. Key Takeaways

• Insider threats involve risks associated with trusted or authorized access.
• Insider risk can be malicious, negligent or caused by a compromised account.
• Least privilege reduces unnecessary access.
• Privileged accounts require stronger controls.
• Separation of duties reduces excessive concentration of authority.
• Access reviews help identify stale and excessive permissions.
• Secure onboarding and offboarding are essential.
• MFA can reduce unauthorized account use.
• Logging supports investigation and accountability.
• Behavioral anomalies require context and investigation.
• Security monitoring should respect applicable privacy requirements.
• Network segmentation can reduce the potential impact of compromised access.
• Risk scores should support investigation rather than automatically label people as malicious.

44. Conclusion

Insider threats require organizations to protect systems without assuming
that every trusted user is dangerous. Effective security combines appropriate
access controls, least privilege, strong authentication, monitoring, security
awareness, careful onboarding and offboarding, segmentation and well-defined
incident-response procedures.

Security professionals should focus on evidence, context and authorized
investigation procedures when evaluating suspicious activity.

The next lesson will examine:
Security Vulnerabilities.