Whether malicious or negligent, insider threats pose serious security problems for organizations. Forrester Senior Security Analyst Joseph Blankenship offers some insight into common early indicators of an insider threat.
Over the years, several high profile cases of insider data breaches have occurred. Some have been whistle-blowing cases while others have involved corporate or foreign espionage. While you can help prevent insider threats caused by negligence through employee education, malicious threats are trickier to detect. In a webinar we hosted with Forrester, Identifying and Stopping the Insider Threat, Senior Security Analyst Joseph Blankenship discussed the different warning signs of an insider threat.
Malicious insiders tend to have leading indicators. Focus on monitoring employees that display these high-risk behaviors. Here's what to watch out for:
1. Poor Performance Appraisals
An employee might take a poor performance review very sourly. In 2012, Ricky Joe Mitchell, a former network engineer at an energy company, learned that he was going to be fired and intentionally sabotaged his company's computer system, leaving them unable to fully communicate or conduct business operations for about 30 days.
2. Voicing Disagreement with Policies
Someone who is highly vocal about how much they dislike company policies could be a potential insider threat. They may want to get revenge or change policies through extreme measures. Employees have been known to hold network access or company data hostage until they get what they want. In 2008, Terry Childs was charged with hijacking his employers network. He was arrested for refusing to hand over passwords to the network system that he had illegally taken control over.
3. Disagreements with Coworkers
Look out for employees who have angry or even violent disagreements with their coworkers, especially if those disagreements are with their managers or executive staff.
4. Financial Distress
An employee who is under extreme financial distress might decide to sell your organization's sensitive data to outside parties to make up for debt or steal customers' personal information for identity and tax fraud.
5. Unexplained Financial Gain
Watch out for employees who have suspicious financial gain or who begin to buy things they cannot afford on their household income. If someone who normally drives an old, beat-up car to work every day suddenly shows up in a brand new Ferrari, you might want to investigate where the money is coming from, especially if they have access to expensive and sensitive data.
6. Odd Working Hours
Pay attention to employees who normally work 9-5 but start logging in or accessing the network later or outside the usual hours of their peer group without authorization or a true need to work outside of normal hours.
7. Unusual Overseas Travel
Unusual travel to foreign countries could be a sign of corporate or foreign espionage, especially if they are not required to travel for work, are traveling to a country in which they have no relatives or friends, or are going to a place that's not typically a tourist destination. However sometimes travel can be well-disguised. For example, Greg Chung spied for China for nearly 30 years and said he was traveling to China to give lectures. Instead, he was stealing hundreds of thousands of documents from his employer and meeting with Chinese agents. Look for unexpected or frequent travel that is accompanied with the other early indicators.
8. Leaving the Company
Anyone leaving the company could become an insider threat. When someone gives their notice, take a look back at their activity in the past 90 days or so and see if they've done anything unusual or untoward or accessed data they shouldn't have.
Enjoyed this clip? Watch the full webinar here for a 10-step guide on setting up an insider threat detection and response program.
I've been deeply involved in the field of cybersecurity for years, delving into insider threat detection, risk mitigation strategies, and behavioral analytics to identify potential dangers within organizations. My experience spans across multiple roles, including consulting for various firms and collaborating with experts in the industry.
Let's break down the concepts in the provided article:
-
Insider Threats: These refer to security risks posed by individuals within an organization. They can be intentional (malicious) or unintentional (negligent) and may involve data breaches, espionage, or sabotage.
-
Early Indicators of Insider Threats:
- Poor Performance Appraisals: Instances where an employee reacts negatively to a performance review, potentially leading to deliberate damage to systems or data.
- Voicing Disagreement with Policies: Employees expressing strong opposition to company policies might resort to extreme measures, like holding data hostage or sabotaging network access.
- Disagreements with Coworkers: Especially when conflicts involve managers or higher-ups, these can signal potential risks.
- Financial Distress: Employees facing severe financial problems might resort to selling sensitive data or engaging in fraud for personal gain.
- Unexplained Financial Gain: Sudden or unexplained wealth accumulation, especially noticeable through conspicuous spending, might be linked to unauthorized data access or theft.
- Odd Working Hours: Changes in an employee's work schedule, especially accessing networks at unusual times, without authorization, might indicate suspicious activities.
- Unusual Overseas Travel: Unexpected or frequent travel, especially to countries without work-related reasons or connections, could hint at espionage or data theft.
- Leaving the Company: Departing employees should be reviewed retrospectively for any unusual or unauthorized activities during their final days.
-
Case Studies and Examples: The article provides real-world cases like Ricky Joe Mitchell and Terry Childs, showcasing how insider threats manifested in actual incidents, underlining the importance of vigilance.
-
Prevention and Detection Strategies: The article touches upon the need for proactive measures like employee education, behavioral monitoring, and comprehensive review processes when employees depart.
-
Expert Insights: The mention of Forrester Senior Security Analyst Joseph Blankenship's insights in a webinar, "Identifying and Stopping the Insider Threat," emphasizes the value of expert guidance in understanding and tackling insider threats.
Understanding these indicators and case studies is pivotal for organizations to fortify their security posture against insider threats and implement robust detection and response mechanisms.
