The term “insider threat” describes an internal threat to an organization’s networks, systems, applications, data, people or property. Insider threats are most often attributed to current and former employees but may also result from allowing trusted access to networks, data, facilities and the like by third-party vendors, contractors, consultants and others.
At a high level, insider threats usually fall into one of two categories:
- Malicious threats. Threats in which damage or compromise to an organization may occur as a result of attacks by a trusted insider with malicious intent. A malicious insider is often motivated by one of the following:
-
- Retribution/Revenge for some perceived wrong
- Money, financial gain
- Intelligence against an adversary
- Whistleblowing
- Informant
- Competitive advantage
- Just for the challenge of it
- Accidental threats. Threats in which damage or compromise to an organization may occur as a result of a mistake or error being made by a good-meaning, trusted insider without any malicious intent.
There are many examples of insider compromises within large, high-profile brands making headlines. However, organizations of all sizes in every business sector and every geography are equally exposed. The fact is that many organizations have been compromised by an insider and do not even realize it.
Here are several best practices that can help organizations limit the risks posed by insider threats:
- Perform background checks on all internal personnel, contractors and consultants.
- Implement a vendor governance program that includes audits and agreement reviews of key, trusted third-party vendors that have access to critical networks, data, applications and systems.
- Assess potential threats from insiders and business partners during enterprise-wide risk assessments.
- Develop and clearly document corporate security policies and procedures. Among others, Acceptable Usage, Mobile Device and Remote Computing and Data Retention and Destruction policies should all be included.
- Disseminate the corporate security policy with all staff and business partners and ask that they formally acknowledge and accept them.
- Incorporate insider threat awareness into periodic security training for all employees.
- Beginning with the hiring process, monitor and respond to suspicious or disruptive behavior.
- Anticipate and manage negative issues in the work environment.
- Know and document your organization’s assets.
- Implement strict password and account management policies and practices.
- Enforce separation of duties and the principle of least privilege.
- Define explicit security agreements for any cloud services, especially access restrictions, as well as monitoring and response capabilities.
- Institute stringent access controls and monitoring policies on privileged users.
- Institutionalize system change controls.
- Use a log correlation engine or security information and event management (SIEM) system to log, monitor and audit employee actions.
- Monitor and control remote access from all end points, including mobile devices.
- Develop and implement a comprehensive employee termination procedure.
- Implement secure backup and recovery processes.
- Develop a formal insider threat program.
- Establish a baseline of normal network device behavior.
- Be especially vigilant regarding social media and properly socialize what is expected and permissible behavior.
- Close the doors to unauthorized data exfiltration.
Security incidents and events caused by insiders often result in costly and disruptive compromises. These events are often hard to identify and usually very difficult for the business to recover from. By adopting meaningful best practices, organizations can alleviate many of the exposures posed by insider threats.
Jeff Bernstein, Managing Director of Critical Defence, has 21 years of information security industry experience dedicated to the protection of critical electronic computing infrastructure. He has worked with many leading financial services, energy, legal and healthcare organizations.
