Insider Threat

Glossary

What is an Insider Threat?

Insider threats pose a complex and dynamic danger to all critical infrastructure sectors’ public-facing and private domains. Defining these threats is important to understanding and implementing an insider threat mitigation program.

Moreover, insider threats are risks that an insider would use to acquire access, purposefully or accidentally, to harm a targeted department’s mission, resources, staff, facilities, information, equipment, networks, or systems. It can also take different forms, such as violence, espionage, sabotage, theft, and cybercrime.

What is an Insider?

An insider is any individual authorised access to an organisation’s resources, including personnel, facilities, information, equipment, networks, and systems.

Some examples of an insider may include:

  1. A person trusted by the organisation, such as employees, members, and those to whom sensitive information and access have been granted.
  2. A person who has been issued a badge or access device that identifies them as having regular or continuous access.
  3. An individual to whom the organisation has provided computer and network access. 4. A person who creates and develops the organisation’s products and services; this group includes people who know the secrets of the items that add value to the organisation.
  4. A person who understands the organisation’s fundamentals, such as pricing, costs, and strengths and limitations.
  5. A person familiar with the organisation’s business strategy and goals is responsible for plans or the means to sustain the organisation and provide for its employees’ well-being.
  6. In the context of government duties, an insider may have access to sensitive information that, if compromised, could endanger national security and public safety.

What is an Insider Threat?

Insider threat refers to the chance of an insider using their allowed access or understanding of an organisation to damage the integrity and infrastructure of a company.

This harm can include purposeful, complacent, or unintentional behaviours that jeopardise the integrity, confidentiality, and availability of the organisation, its data, personnel, or facilities.

What are the Types of Insider Threats?

Unintentional Threat

  1. Negligence: An insider of this type risks an organisation by negligence. Negligent insiders are often aware of security and IT policies but prefer to ignore them. One example is allowing someone to “piggyback” across a secure access point, such as misplacing or losing a storage device containing sensitive information and disregarding alerts to install new updates and security patches.
  2. Accidental: This type of insider inadvertently puts an organisation in danger. Examples include mistyping an email address and inadvertently sending a business document to a competitor, unknowingly or inadvertently clicking on a hyperlink, downloading a malware-laden attachment in a phishing email, or inappropriately disposing of sensitive documents.

Intentional Threats

The intentional insider is called a “malicious insider.” Intentional threats are actions to harm an organisation for personal gain or to address a grievance. For example, many insiders are motivated to execute revenge due to a perceived lack of acknowledgement or firing. Their acts may include leaking sensitive information, harassing coworkers, destroying equipment, committing violence, or stealing private data or intellectual property in the mistaken hope of furthering their careers.

Other Threats

  1. Collusive Threats: This classification is a subset of harmful insider threats in which one or more insiders work with an external threat actor to compromise an organisation. These attacks usually include cybercriminals hiring one or more insiders to commit fraud, intellectual property theft, espionage, or a combination of the three.
  2. Third-Party Threats: Third-party threats are often contractors or vendors who are not formally members of an organisation but have been provided access to facilities, systems, networks, or people to fulfil their tasks. These risks can be direct or indirect.

How Does an Insider Threat Occur?

Insider threats can take different forms, including violence, espionage, sabotage, theft, and cybercrime. Insider threats are defined in detail below.

  1. Violence: This action has the threat of violence and threatening behaviours that develop an intimidating, abusive, or hostile environment.
  2. Espionage: Espionage is the stealthy or illicit method of spying on a foreign government, organisation, entity, or person to acquire confidential information for military, political, strategic, or financial advantage.
  3. Sabotage: Sabotage describes actions that harm an organisation’s physical or virtual infrastructure, including noncompliance with maintenance or IT procedures, physically damaging facilities, or deleting code to disrupt or obstruct regular operations.
  4. Theft: Theft is the action of stealing, whether money or intellectual property.
  5. Cyber: Cyber threats include theft, espionage, violence, and sabotage of anything relevant to technological devices or the internet.

How can iZOOlogic help my Company or Organisation?

Find out how iZOOlogic can resolve or address these Insider Threats through our Digital Risk and Compliance solutions.

To find out more about how iZOOlogic can help protect your company’s cyber security, schedule a demo.