What is Insider Threat?
According to US-CERT, an insider threat occurs when a current or former employee, contractor, or other business partner with authorised access to an organisation’s network, systems, or data misuses it to negatively affect the confidentiality, integrity, or availability of the organisation’s information or systems. These situations often entail the compromise or misuse of login credentials and-or the theft of intellectual or financial assets—all of which can lead to substantial ramifications for the company. Despite the potential severity of the insider threat, many businesses operate under the common misconception that their employees are trustworthy and would never abuse their access. This mindset also ignores the unintentional insider threat where an accidental misuse of systems poses a similar risk. For instance, if an employee’s computer becomes infected with malware following a spear-phishing attack or social engineering scam, the infection could compromise sensitive data to which the employee has access. This doesn’t mean that businesses should not trust their employees, but it does mean that password hygiene, user-access controls, bring-your-own-device, and acceptable-use policies should be stringent, continually enforced, and frequently updated as necessary across the company.
Insider Threat Programs and User Behaviour
With an insider threat program, businesses can analyse a pattern of user behaviour to proactively gauge if, when, and how the user’s actions could compromise business interests. Consequently, businesses without sufficient visibility into these behaviour patterns may overlook small-yet-significant events that can indicate the early stages of an insider threat. For example, when a visit to a suspicious website or an email exposing sensitive data are viewed as innocent mistakes rather than potential indicators of an insider threat, companies may not address these behaviours appropriately. Insider threat programs are designed to identify and evaluate these issues and the extent to which they align with a user’s normal behaviour patterns. This process can help businesses effectively identify and mitigate potential insider threats proactively.
Functional and Organisational Maturity
Before a company can build out its Insider threat capabilities, it must assess its functional and organisational maturity. Organisational maturity refers to the company’s ability to leverage threat intelligence based on its people and structure. Functional maturity refers to how well the company has implemented and executed on the goals of its security program.
Assessing a company’s organisational maturity starts with understanding the way its security programs protect its assets. The goal for most companies is for their security programs to transition to a more proactive approach where they are leveraging intelligence to anticipate potential threats and address overall business risk proactively. This entails using contextual intelligence to uncover emerging threats, learning how these threats operate, and determining the extent to which these threats could potentially impact the business.
After evaluating and benchmarking its organisational maturity, a company should assess its functional maturity to determine how well its teams are able to accomplish the objectives of its security program. Are teams responding to incidents as they appear, or are they investigating potential problems and proactively adjusting processes to mitigate risk? Companies also need to understand how they are leveraging intelligence and the sustainability and repeatability of existing processes.
Many companies don’t have the resources to create a robust insider threat program capable of anticipating threats pre-emptively, but assessing functional and organisational maturity can provide insight into whether a company is ready to take on these advanced goals.
The Best Place to Start
For companies that have yet to implement or fully develop an insider threat program, there are still basic steps that can help mitigate the risk. In particular, adjusting the employee off-boarding process can help companies become substantially less susceptible to insider threat. This process could include simple yet effective actions such as ensuring exiting employee accounts are closed, access privileges revoked, and login credentials invalidated in a timely manner. After all, if a former employee maintains valid access to company assets, any misuse would not trigger alerts. Given that many insider threat incidents have been linked to former employees, proper off-boarding can significantly lower these risks.
Another effective mitigation strategy is for companies to audit identity and access management (IAM) systems that manage users’ access to sensitive systems and information. Two common practices for organisations are an annual recertification process and a management approval process for employees receiving new entitlements. Incorporating layers of security into the protocol for granting access to users is fundamental in the defence against insider threat. Auditing this process often to ensure that all users have the appropriate amount of access and there is no potential misuse of privileges is key to mitigating the risks posed by insider threat.
