Insider Threats

Layer 8: People High risk

How it works

Insiders already have what outside attackers work hard to obtain: valid accounts and knowledge of where valuable information lives. A malicious insider might copy client lists before leaving for a competitor, sabotage systems after a dispute, or sell access to criminals. Former employees whose accounts were never disabled can be just as dangerous. Contractors and vendors with standing access to systems fall into the same category and deserve the same attention.

Many insider incidents are not malicious at all. A well-meaning employee might email sensitive files to the wrong person, share a folder publicly, or bypass security controls to get work done faster. Because insiders use normal tools and permissions, their actions can be hard to distinguish from everyday work without good access controls, logging and a clear offboarding process. Mistakes are far more common than malice, which is why clear processes and supportive training matter.

Warning signs

• Large downloads or file copies, especially before a resignation
• Access to data unrelated to someone's role
• Accounts of former staff still active or in use
• Attempts to disable monitoring or security tools
• Sharing of sensitive files with personal addresses

How to defend against it

• Grant the least access each role needs and review it regularly
• Disable accounts promptly as part of offboarding
• Log and alert on unusual file access and transfers
• Use data loss prevention for sensitive information
• Set clear acceptable use and confidentiality policies

If it happens to you

1. Suspend the account and preserve logs before confronting anyone
2. Involve HR and legal counsel early
3. Determine what data was accessed or taken
4. Assess privacy breach reporting obligations